Tutorials › Power BI › Row-Level Security (RLS) in Power BI

Row-Level Security (RLS) in Power BI

Restrict data access by user — so each person only sees their own region or team data

Row-Level Security (RLS) restricts which data rows a user can see in a published Power BI report. For example: the Delhi sales manager sees only Delhi data, Noida manager sees only Noida data — but both use the same report. The filter is applied automatically based on who logged in. RLS is a common interview question for data analyst roles that involve Power BI — understanding it shows you can build production-grade reports, not just demo dashboards.
Row-Level Security — One Report, Different Views
Same .pbix file, same dashboard URL — each user sees only their permitted data
👤
Anjali (Delhi Mgr)
anjali@co.com
USERPRINCIPALNAME() = "anjali@co.com"
Delhi data only
👤
Rohit (Noida Mgr)
rohit@co.com
USERPRINCIPALNAME() = "rohit@co.com"
Noida data only
👤
Sonal (VP Sales)
sonal@co.com
USERPRINCIPALNAME() = "sonal@co.com"
All regions
Static RLS
[Region] = "Delhi"
One role per region — doesn't scale
Dynamic RLS ✓
[Email] = USERPRINCIPALNAME()
One role, scales to any number of users

Example

Setting up Static RLS
STATIC RLS (same filter for everyone in a role):

STEP 1 — Create a role:
  Modeling tab → Manage Roles → Create
  Name the role: "Delhi Manager"

  Select the table to filter (e.g., Sales or a Region dim table)
  Write a DAX filter:
  [Region] = "Delhi"
  → Click the checkmark → Save

STEP 2 — Test the role:
  Modeling tab → View as → Select "Delhi Manager"
  → Report now shows only Delhi data
  → Click "Stop viewing" to return to normal

STEP 3 — Publish and assign:
  Publish report to Power BI Service
  In Power BI Service: Dataset → Security
  Add users/groups to each role (email addresses)

  Now when Delhi Manager logs in → sees only Delhi
  When Noida Manager logs in → sees only Noida

DYNAMIC RLS (filter based on logged-in user):
  Create a mapping table:
    Email        | Region
    delhi@co.com | Delhi
    noida@co.com | Noida

  Create a single role with DAX:
  [Email] = USERPRINCIPALNAME()
  → Automatically filters to the logged-in user's region
💡 Dynamic RLS scales to thousands of users — no need to create individual roles for each person.

Key Points

  • ✓RLS is defined in Power BI Desktop but assigned to users in Power BI Service
  • ✓USERPRINCIPALNAME() returns the email of the logged-in Power BI user — key for dynamic RLS
  • ✓RLS on dimension tables propagates to related fact tables via relationships
  • ✓Report owners and workspace admins bypass RLS — they always see all data
  • ✓Test RLS with "View as" in Desktop before publishing

Practice Question

Which DAX function returns the email address of the currently logged-in Power BI user — used for Dynamic RLS?