Copying security model from Dynamics 365 to Power BI

[AlexeyRusinov]

Hello everyone,

I am using Power BI with Dynamics 365 and I need your help. My goal is to let Power BI users see exactly the same data that they can see in Dynamics 365. Is it possible to do?

Before starting work with Dynamics 365, I had CRM on-premise. Data from CRM was uploaded to SSAS database, and for each user the role was created, with row-level security on all major entities. The job was launched every hour.

Now I need to do something similar to Dynamics 365. My questions are:

• Maybe there is a Power BI connector that already includes security, and there is no need for additional effort? If yes, which one is it?
• If not, what is the best approach to do achieve same security in Power BI that exists in Dynamics 365?
• Does Power BI REST API allows recreating row-level security, similar to SSAS? Is it ok to call every hour, for the system?

Will be grateful for any advice.

[v-qiuyu-msft]

Hi @AlexeyRusinov,

In your scenario, you can connect to Dynamics 365 in Power BI desktop follow this article: Use Power BI Desktop to connect directly to your Microsoft Dynamics 365 (online) instance.

After import data to desktop, you can create RLS role and utilize the role after publish to service, for more information, see: Row-level security (RLS) with Power BI. With RLS defined on Power BI side, each time user access the report will be applied.

Best Regards,
Qiuyun Yu

[AlexeyRusinov]

Hi @v-qiuyu-msft,

Thank you for your response. I have some questions I need to clarify.

1) Am I correct that Dynamics 365 connector to Power BI does not include security, so Ihave to add RLS myself to get the same security levels that exists in D365?
2) Is there an API that allows to update RLS, so it is kept up-to-date automatically every time new entity appears, or user role changes?

Best regards,
Alex

[v-qiuyu-msft]

Hi @AlexeyRusinov,

1. When you connect to Dynamics 365, data are retrieved based on which permission you granted with entered credential. For example, you can set this account to access only one report, then this account can just retrieve this report data when connect to Dynamics 365. Then in Power BI, regarding this retrieved data, you can create a role to limit who can view how many retrieved data. RLS on Power BI is to filter on already retrieved data.

2. On Power BI side, to change RLS role, we need to download the report from service then modify the role in Power BI desktop, then republish the report to service. If you want to apply the role to new member, you need to add this member manually for dataset ->Security. Currently, Power BI rest API doesn't provide feature to modify RLS.

Best Regards,
Qiuyun Yu

[AlexeyRusinov]

1. But when the report is built, it retrieves all available data for it, right? Unless I set RLS, and retrieved data will be filtered by this RLS.
So if the user in D365 sees 5/10 records, in report he will see all 10 records, unless I set RLS?
2. I understand, thank you very much for your feedback.

[v-qiuyu-msft]

---

@AlexeyRusinov wrote:

1. But when the report is built, it retrieves all available data for it, right? Unless I set RLS, and retrieved data will be filtered by this RLS.
So if the user in D365 sees 5/10 records, in report he will see all 10 records, unless I set RLS?

---

@AlexeyRusinov Yes, your understanding is right.

If you are satisfied with our response, would you please mark a helpful reply as an answer so we can close this thread?

Best Regards,
Qiuyun Yu