Power BI Intermediate Lesson 8: Row-Level Security (Static and Dynamic)

📎 This article includes 3 downloadable practice files ↓

📘 Power BI Intermediate Course · Lesson 8 of 10

One report, four regional managers, and each must see only their region. Row-level security (RLS) filters the data by who is signed in.

Static roles

Modeling > Manage roles > New: role North, table Customers, filter [Region] = "North". Repeat per region and assign people to roles in the Power BI Service. Simple, but one role per region.

Dynamic RLS: one role for everyone

1. A RegionUsers table: Email, Region (in the practice model).
2. Relationship RegionUsers[Region] (one) → Customers[Region] (many), single direction.
3. Role “Region users”, table RegionUsers, filter [Email] = USERPRINCIPALNAME().

The signed-in user’s row filters Customers, which filters Sales. New manager? Add a row to the table, no model change.

Test in Desktop: Modeling > View as > Other user + the role.

Practice

Import pbi-intermediate-model.xlsx into Power BI Desktop (free), create the relationships listed at the top of the .dax file, mark the Date table as a date table and add this lesson’s measures. Compare your card and table values with the lesson’s sheet in the expected-results file. Those numbers were worked out independently in Python from the same data, so a mismatch means a filter or relationship to check.