How to implement line-level security in an Analysis Services model?

[matdub40]

I have a data model that is like this:

Joins are done between tables on storenumber and storename.

I would like to give access to the stores staff but they only see the sales of their own store. I added their mail in the table Y2_Stores.

The sales data are in the table Y2_Sales.

I added the Y2_StoreEmployee table with storenumber | email and made a relation on storenumber in double direction to the Y2_Stores table :

Relationships:

I created a role with this formula:

but when I connect with the email I put in the Y2_StoreEmployee table I still see all the sales... is there anything else to do?

Can you help me ?
Thanks

[v-rongtiep-msft · Accepted solution]

Hi @matdub40 ,

It seems there is nothing wrong with the formula. Row-level security (RLS) with Power BI can be used to restrict data access for given users. Filters restrict data access at the row level, and you can define filters within roles. In the Power BI service, members of a workspace have access to datasets in the workspace. RLS doesn't restrict this data access.

For Analysis Services or Azure Analysis Services lives connections, you configure Row-level security in the model, not in Power BI Desktop. The security option will not show up for live connection datasets.

Please check the role in the workspace. Please check where the Y2_Stores[email] is the same as the current logged on Windows user name, and Y2_Stores[storenumber] is the same as the Y2_Sales[detail_number]).

Please check the RLS "view as a user " on the desktop. 

If it still does not help , please provide your pbix file without privacy information for us testing or provide more details with screenshots.

Best Regards

Community Support Team _ Polly

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[matdub40]

Thank you very much for your answer! @v-rongtiep-msft 
Indeed, the members of the BI group in Azure were owners of the workspace so they could see everything.
I just made the change by putting the email as the workspace viewer and it works!

What is the best thing to do because there is the workspace, the application and in this application my Power BI report which must be filtered. Where should the viewer permission be put?

Maybe add them as a reader of the report and send them the link?

[matdub40]

Hi @v-rongtiep-msft,

I have already done everything you describe in your answer.

Where I'm stuck is writing the DAX formula at row level in Analysis Services (step 4 of task 2 in your link). I have tried several but when the user logs in he still sees all the rows.

Can you help me write the correct DAX formula in my case?

Thanks

[v-rongtiep-msft]

Hi @matdub40 ,

Implement row-level security in an on-premises Analysis Services Tabular Model and use it in a Power BI report.

• Create a new security table in the AdventureworksDW2012 database
• Build the tabular model with necessary fact and dimension tables
• Define user roles and permissions
• Deploy the model to an Analysis Services tabular instance
• Build a Power BI Desktop report that displays data tailored to the user accessing the report
• Deploy the report to Power BI service
• Create a new dashboard based on the report
• Share the dashboard with your coworkers

More details : Dynamic row-level security with Analysis services tabular model - Power BI | Microsoft Docs

Best Regards

Community Support Team _ Polly

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.