Tutorials › Power BI › Row-Level Security (RLS) in Power BI

Row-Level Security (RLS) in Power BI

Restrict data access by user — so each person only sees their own region or team data

Row-Level Security (RLS) restricts which data rows a user can see in a published Power BI report. For example: the Delhi sales manager sees only Delhi data, Noida manager sees only Noida data — but both use the same report. The filter is applied automatically based on who logged in. RLS is a common interview question for data analyst roles that involve Power BI — understanding it shows you can build production-grade reports, not just demo dashboards.
Row-Level Security — One Report, Different Views
Same .pbix file, same dashboard URL — each user sees only their permitted data
👤
Anjali (Delhi Mgr)
anjali@co.com
USERPRINCIPALNAME() = "anjali@co.com"
Delhi data only
👤
Rohit (Noida Mgr)
rohit@co.com
USERPRINCIPALNAME() = "rohit@co.com"
Noida data only
👤
Sonal (VP Sales)
sonal@co.com
USERPRINCIPALNAME() = "sonal@co.com"
All regions
Static RLS
[Region] = "Delhi"
One role per region — doesn't scale
Dynamic RLS ✓
[Email] = USERPRINCIPALNAME()
One role, scales to any number of users

Example

Setting up Static RLS
STATIC RLS (same filter for everyone in a role):

STEP 1 — Create a role:
  Modeling tab → Manage Roles → Create
  Name the role: "Delhi Manager"

  Select the table to filter (e.g., Sales or a Region dim table)
  Write a DAX filter:
  [Region] = "Delhi"
  → Click the checkmark → Save

STEP 2 — Test the role:
  Modeling tab → View as → Select "Delhi Manager"
  → Report now shows only Delhi data
  → Click "Stop viewing" to return to normal

STEP 3 — Publish and assign:
  Publish report to Power BI Service
  In Power BI Service: Dataset → Security
  Add users/groups to each role (email addresses)

  Now when Delhi Manager logs in → sees only Delhi
  When Noida Manager logs in → sees only Noida

DYNAMIC RLS (filter based on logged-in user):
  Create a mapping table:
    Email        | Region
    delhi@co.com | Delhi
    noida@co.com | Noida

  Create a single role with DAX:
  [Email] = USERPRINCIPALNAME()
  → Automatically filters to the logged-in user's region
💡 Dynamic RLS scales to thousands of users — no need to create individual roles for each person.

Key Points

  • ✓RLS is defined in Power BI Desktop but assigned to users in Power BI Service
  • ✓USERPRINCIPALNAME() returns the email of the logged-in Power BI user — key for dynamic RLS
  • ✓RLS on dimension tables propagates to related fact tables via relationships
  • ✓Report owners and workspace admins bypass RLS — they always see all data
  • ✓Test RLS with "View as" in Desktop before publishing

Practice Question

Which DAX function returns the email address of the currently logged-in Power BI user — used for Dynamic RLS?

Related Topics

Power BI Service — Publishing and SharingPublish reports to Power BI Service, organise in workspaces, and share with colleaguesFILTER, ALL and ALLEXCEPTControl and remove filter context with FILTER, ALL, ALLEXCEPT and ALLSELECTEDThe Data Model in Power BIWhat a data model is and why it is the foundation of every good Power BI report