Create a Role to Ignore Role Level Security?

[Anonymous]

Okay. So I have a basic role set up and it's working fine. I have a two tables that are joined together and have checked the "Apply security filter in both directions" box. So when a user logs in, the system "sees" their department (from Table A) and filters out any / all other departments from Table B. They only see what they should.

The question is, can I make a second role that "ignores" this rule for a specific individual? I want it so that anyone from "Dept Z" can see information from all departments, rather than those from only "Dept Z". 

This is also setup in a group, so that each person of the group only has "view" access and I can't change it so that they're admin. 

Any help / thoughts / guidance would be appreciated.

Thanks,

Jonathan 

[v-qiuyu-msft · Accepted solution]

Hi @Anonymous,

If I understand it correctly, you already created a RLS role for users to access data belong to their department. And you want to set one of the department (eg: "Dept Z") can view all department data, right?

When you add the members under the role in dataset security, please do not add the users from "Dept Z". You can create a security group which includes all departments except "Dept Z", then add this group under the role. See: Working with members.

Best Regards,
Qiuyun Yu

[Anonymous]

@v-qiuyu-msft,

Thanks. That helped. I didn't realize that each user in the group had to be assigned some kind of role in order to see any data. I had (incorrectly) assumed they would see data without being tied to a specific role, just by being a member of the group itself. 

Thanks again.

Jonathan