Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Grow your Fabric skills and prepare for the DP-600 certification exam by completing the latest Microsoft Fabric challenge.

Reply
Mlemmers
Helper I
Helper I

Help organizational hierarchy RLS


Hi,

 

I need some help setting up a hierarchy in RLS in PBI. In this scenario (see data below) we have Selma owning department 1 and 2. If I give her access to department 1 and 2 then she can't see all the departments below her, which she should. Klaus, for example, owns 1.1 so he should see that and everything below that. I'm going a little bit insane: I want to check whether the user logged in is the person responsible for that department and they need to see everything belonging to the departments below that as well. 

 

This article doesn't go into how to handle those cases, as the workaround here isn't enough for my scenario https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi

A similar question popped up on the forums years ago but the video referred to isn't there anymore? https://community.fabric.microsoft.com/t5/Desktop/RLS-with-org-hierarchy/m-p/1134611#M516493


Dummy data (note that Selma owns 2 departments, owner is not unique)

DepartmentParentOwneremailPathLevel 1Level 2Level 3Level 4
1nullSelmaSelma@example.com11nullnullnull
2nullSelmaSelma@example.com22nullnullnull
3nullBillBill@example.com33nullnullnull
1.11KlausKlaus@example.com1|1.111.1nullnull
1.21BlairBlair@example.com1|1.211.2nullnull
1.1.11.1ReneRene@example.com1|1.1|3.1.111.11.1.1null
2.12KatyKaty@example.com2|2.122.1nullnull
3.13SueSue@example.com3|3.133.1nullnull
3.1.13.1WilmerWilmer@example.com3|3.1|3.1.133.13.1.1null
3.1.1.13.1.1RichardRichard@example.com3|3.1|3.1|3.1.1.1.133.13.1.13.1.1.1
1 ACCEPTED SOLUTION

yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.

View solution in original post

5 REPLIES 5
lbendlin
Super User
Super User

Treat your access permissions as lists

 

Selma = {1,2}

 

Then in your RLS rules you can test against these lists

 

Department Level 1 in {1,2} => Selma is permitted

This is on me for not mentioning it before, but an approach like that wouldn't work if I have 60 of those cases, which I have. 

Why would that not work? We have similar implementations with hundreds of such rule sets.

But then you have hundreds of manual lines? Can you talk me through this implementation more because now I feel like I'm missing some vital information. 
You set up a rule with the DAX editor of the RLS implementation, do you use USERPRINCIPALNAME()? 
So Blair should also have access to deparment 1.1.1 because that belongs to 1.1 and Selma has access to all there. How do I set it up step by step? 
Level 1 in what exactly, do I need to give a list with a hundred items or can I use a VALUES() here and how does the USERPRINCIPALNAME come in?

yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.

Helpful resources

Announcements
RTI Forums Carousel3

New forum boards available in Real-Time Intelligence.

Ask questions in Eventhouse and KQL, Eventstream, and Reflex.

MayPowerBICarousel1

Power BI Monthly Update - May 2024

Check out the May 2024 Power BI update to learn about new features.