Row-level security (RLS) with Power BI Desktop can be used to restrict data access for given users. Filters restrict data at the row level. You can define filters within roles.

Note:

RLS is a Pro feature. You can read more about what Pro content is.

You can now configure RLS for data models imported into Power BI with Power BI Desktop. You can also configure RLS on datasets that are using DirectQuery, such as SQL Server. Previously, you were only able to implement RLS within on-premises Analysis Services models outside of Power BI. For Analysis Services live connections, you configure Row-level security on the on-premises model. The security option will not show up for live connection datasets.

Important:

If you defined roles/rules within the Power BI service, you will need to recreate those roles within Power BI Desktop and publish the report to the service.

Learn more about options for RLS within the Power BI Service.

Define roles and rules within Power BI Desktop

You can define roles and rules within Power BI Desktop. When you publish to Power BI, it will also publish the role definitions.

If you want to take advantage of dynamic security, you will need to enable the preview switch Enable cross filtering in both directions for DirectQuery. This will allow the ability to cross filter and apply the security filter in both directions.

To define security roles, you can do the following.

  1. Import data into your Power BI Desktop report, or configure a DirectQuery connection.

    Note:

    You cannot define roles within Power BI Desktop for Analysis Services live connections. You will need to do that within the Analysis Services model.

  2. Select the Modeling tab.

  3. Select Manage Roles.

  4. Select Create.

  5. Provide a name for the role.

  6. Select the table that you want to apply a DAX rule.

  7. Enter the DAX expressions. This expression should return a true or false. For example: [Entity ID] = “Value”.

    Note:

    You can use username() within this expression. Be aware that username() will have the format of DOMAIN\username within Power BI Desktop. Within the Power BI service, it will be in the format of the user's UPN.

  8. After you have created the DAX expression, you can select the check above the expression box to validate the expression.

  9. Select Save.

You cannot assign users to a role within Power BI Desktop. This is done within the Power BI service. You can enable dynamic security within Power BI Desktop by making use of the username() DAX functions and having the proper relationships configured.

Validating the role within Power BI Desktop

After you have created your role, you can test the results of the role within Power BI Desktop. To do this, select View As Roles.

The View as roles dialog allows you to change the view of what you are seeing for that specific user or role. You will see the roles you have created.

You select the role you created and then select OK to apply that role to what you are viewing. The reports will only render the data relevant for that role.

You can also select Other user and supply a given user. It is best to supply the User Principal Name (UPN) as that is what the Power BI service will use. Select OK and the reports will render based on what that user can see.

Note:

Within Power BI Desktop, this will only display different results if you are using dynamic security based on your DAX expressions.

Limitations

Here is a list of the current limitations for row-level security on cloud models.

  • If you previously had roles/rules defined within the Power BI service, you will need to recreate them within Power BI Desktop.
  • You can define RLS only on the datasets created using Power BI Desktop client. If you want to enable RLS for datasets created with Excel, you will need to convert your files into PBIX files first. Learn more
  • Only ETL, and DirectQuery connections are supported. Live connections to Analysis Services are handled in the on-premises model.
  • Q&A and Cortana is not supported with RLS at this time. You will not see the Q&A input box for dashboards if all models have RLS configured. This is on the roadmap, but a timeline is not available.
  • External sharing is not currently supported with datasets that use RLS.

Known issues

There is a known issue where you will receive an error message when trying to publish from Power BI Desktop if it was previously published. The scenario is as follows.

  1. Anna has a dataset that is publised to the Power BI service and has configured RLS.

  2. Anna updates the report in Power BI Desktop and re-publishes.

  3. Anna will receive an error.

Workaround: Re-publish the Power BI Desktop file from the Power BI service until this issue is resolved. You can do that by select Get Data > Files.

FAQ

Question: What if I had previously created roles/rules for a dataset in the Power BI service? Will they still work if I do nothing? Answer: No. Visuals will not render properly. You will have to re-create the roles/rules within Power BI Desktop and then published to the Power BI service.

Question: Can I creates these roles for Analysis Services data sources? Answer: You can if you imported the data into Power BI Desktop. If you are using a live connection, you will not be able to configure RLS within the Power BI service. This is defined within the Analysis Services model on-premises.

See also

Row-level security (RLS) with the Power BI service
More questions? Try the Power BI Community