Best Practices RLS

[Gdps]

Hello everyone,

I would like to ask your help to tell me what would be the best practice for creating an RLS for my report.

My situation:

I have a premium workspace with 60 people in Microsoft Teams, and I want to share a report with those 60 people. The report is about hours of work recorded in a sharepoint list.

However, I need to have 3 types of visualization:

• Director View: can see all the information in the report. There are 4 directors.
• Manager View: can see information about their team. There are 8 managers.
• Resource View: can see only their own information. There are 48 resources.

Note: the manager needs to see his own information, in addition to their team information

I managed to create the RLS using an excel database with the following columns:

Resource Name

Resource E-Mail

Manager Name

Manager E-Mail

But I found exhausting add 48 emails manually in the Security tab of the bi power service.

Is there a more practical way to do this? And to share this report, do I also need to manually add the 60 emails?

Best Regards,

[v-diye-msft · Accepted solution]

Hi @Gdps 

I believe you can refer to the dynamical hierarchy RLS:

https://radacad.com/dynamic-row-level-security-with-manager-level-access-in-power-bi

https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi

https://radacad.com/dynamic-row-level-security-with-power-bi-made-simple

do I also need to manually add the 60 emails?

No, when you manage them in the DAX formula, you can create a distribution list/Security group including their emails, and add the group directly in service.

[GilbertQ]

Hi there

You can use Active Directory Security Groups within the Security tab of the Power BI Service.

I do have a blog post which explains how to do this easily using Active Directory Security Groups
https://www.fourmoo.com/2018/02/20/dynamic-row-level-security-is-easy-with-active-directory-security...

Also you can create an App and put in the same AD Security Group under permissions which will grant them all permissions to the app