Dynamic Row-Level Security for Manager Level in Power BI? | RLS In Power BI Ep4

No video

Dynamic Row-Level Security for Manager Level in Power BI? | RLS In Power BI Ep4 | BI Consulting Pro

Рет қаралды 21,759

BI Consulting Pro

Күн бұрын

Пікірлер: 38

@BIConsultingPro 6 ай бұрын

RLS Demo File: biconsultingpro-my.sharepoint.com/:f:/p/connect/EpX3ovY78RtNhVOJK_lnDMMB8-hgyiQdtcM4zspBbWTc3w?e=WbQCeG

@vijais3576 Жыл бұрын

Best video for RLS 👍

@roopalityagi3958 Жыл бұрын

In addition to above i want to restrict managers to see own department data only

@user-vo7nh8jv2v 8 ай бұрын

If you are adding employees / manager email id into the power bi server then how it can be dynamic RLS. If manager changes for any account then again we have to add their email id to the server. This need to do every time if employee or manager changed.

@BIConsultingPro 8 ай бұрын

That's a good question and thanks for asking this. Here, Dynamic means that you don't need to do anything from Power BI service end once the report is published. Anytime when a user login on Power BI Service, he will see what he is entitled too. Now, let's talk about Server side. As per your case whenever there is a change in data like manager is leaving or a new manager is coming, then it's a change in your data source, Not in Power BI. Data needs to be updated to reflect there. Power BI just reads the data, not write the data. Hence, it can only read what's in there. It can make things dynamic as per user login but can't update the data in the database. I hope this answers your question. Have a great day!!

@bhargavibp7043 2 жыл бұрын

Dear Sir ... very useful, Awesome series..

@BIConsultingPro Жыл бұрын

Thanks and welcome

@hotboyphil 2 жыл бұрын

I have a similar problem: I have sales and sales manager, security is through an AD group which contains all sales and sales manager e-mails. currently i use 2 rls, but i don't think it will work with 1 ad group. how do i create a similar rule to yours to switch to the right group. so its like yours except your 0,1 is managers e-mails. manager see their sales peoples accounts, sales should see only their own accounts.

@samsal073 2 жыл бұрын

Hi , I have a question please. I noticed for dynamic RLS you had to go the Security of the DataSet and add user under Members! I thought the point of dynamic RLS is that you dont have to do that if the users have viewer access , no? Otherwise if I have too many viewers then I have to add all of them to the dataset security?

@BIConsultingPro 2 жыл бұрын

Hi, Thanks for your comment/feedback. No matter what kind of RLS you are applying, you need to add members to the corresponding roles. If you have many users, you can add them in AD group (Active Directory Groups like you Email Groups) and then you can add those groups to your security roles. Once you'll do this, you just need to manage your AD group, not the role members in Power BI Datasets.

@samsal073 2 жыл бұрын

@@BIConsultingPro thank you sir I appreciate your reply

@hrithikpradeep4559 9 ай бұрын

Hi, I am encountering the following issue. Please help me out. An error was encountered during the evaluation of the row level security expression defined on table 'User Roles'. Error message: DAX comparison operations do not support comparing values of type Text with values of type Integer. Considering the VALUE or FORMAT function to convert one of the values. I have done eveything according to your video My isManager is also whole number

@BIConsultingPro 9 ай бұрын

It’s because you have different data types in your DAX calculation. Please check the data types, both should be the same.

@srinupampana3814 Жыл бұрын

Hi, thanks for the brilliant tutorial about the RLS. It's worked for me, but I have an issue, if i add an email ID which is not existing my security table and it start showing all the values in view as roles. How can we achieve this problem. It should not show anything if we add any external email ID, which is not exist in the table.

@BIConsultingPro Жыл бұрын

RLS will only work if the email address added to the roles. If it is left out, you need to write your logic in a way that if email address is not in the group, it won't show data.

@chetanshinde1992 5 ай бұрын

can we use pathcontains dax function for dynamic rls

@BIConsultingPro 5 ай бұрын

Ideally yes… and I highly encourage you to try it out and share your results

@nidhi5823 2 жыл бұрын

I am having Manager email and Sales person email where I want manager should see his own data + his sales person data where sales person can see only his own data... how can I achieve that through this For this I have used 2rls for manager and sales person

@hotboyphil 2 жыл бұрын

yup similar position with my post above. would want 1 rls for both

@michaelungar241 Жыл бұрын

Great video, thank you!! Is there a way to implement this for multi level rls? meaning some managers can only see certain employees, and then have a director level over everything.

@BIConsultingPro Жыл бұрын

Please check the whole series. It should be in this.

@sama2880 Жыл бұрын

How can I achieve for my scenario that I have two pages, one overview and two employee progress? I'd like to use my AD as a log in and when a user logs in, Manager and above can see both pages, but employees can only see their page, which is number two. I looked into page level security but involves creating extra slicer and navigation is there way to avoid it and just use RLS? I am just confused about Employee page as i want to make them to land to their report page only.

@ripunjayandavolu846 2 жыл бұрын

Can we implement RLS on Direct Query method ??

@BIConsultingPro 2 жыл бұрын

Good Question! Yes, you can also configure RLS on datasets that are using DirectQuery, such as SQL Server. However, you won't be able to test roles. For more info: docs.microsoft.com/en-us/power-bi/admin/service-admin-rls

@VarunKumar-ps4iw Жыл бұрын

How is this different from the basic RLS. It again depends on the access type the user has for the workspace . If I have admin access to the workspace and mark myself as not an admin in the example you gave. Will the RLS still apply to me ?

@BIConsultingPro Жыл бұрын

Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn't apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role. Dynamic RLS is different from basic as it would automatically changes for individual users. Basic one is act like a fixed filter which would be same for everyone.

@ganeshrkamath8781 2 жыл бұрын

How MAXX really helps? Can we write the DAX function without MAXX? Pls guide!

@BIConsultingPro 2 жыл бұрын

I can explain you a lot over this, however try MAX first here, and then Try MAXX. You'll understand yourself. Also, please go through DAX function definitions as well. If you still cannot figure it out, kindly let me know.

@pradeepgowtham3134 2 жыл бұрын

For all of the users you shared, have you given only " Viewer" access? Nobody is an admin or contributor ?

@BIConsultingPro 2 жыл бұрын

All are viewers. Please don't grant admin or contributor access to any other users, otherwise they might see all the records.

@pradeepgowtham3134 2 жыл бұрын

@@BIConsultingPro thank you

@pradeepgowtham3134 2 жыл бұрын

Hi, I have seen all RLS vidoes till organization hierarchy security. You are showing security for users in rows in table. What about security of reports and dashboards while sharing the reports and dashboards. Are both same? Thank you

@BIConsultingPro 2 жыл бұрын

@@pradeepgowtham3134 Thanks for your question. RLS means row-level security, and this can be applied only at the row level. If you can stop the data on row-level you can maintain the security by data. However, if you want to maintain security for repots and dashboards, you need to grant them access via Apps or by repots, or by dashboards while sharing with them.

@vrushalipatil7925 2 жыл бұрын

I am importing insurance data (view - having global data ) from Amazon redshift through ODBC connection. I want to apply RLS based on country and contract signed date ( for each country, contract signed date is different.) Report is published in workspace (new workspace type with premium licence applied) Requirement is to create role for each country and create one role as a global where we will see the data for all country after particular date(date column is available in view) I want to assign 2 roles to single user. For ex. XYZ person want to see global data as well as Australia's data. Can you tell me what will be the output for this? Is it possible to apply Row Level Security in above scenario ? Please let me know awaiting for your reply.

@BIConsultingPro 2 жыл бұрын

You can include a user in multiple roles. However, if you would include the same uses in a "Global" role, that would override all other roles.

@vrushalipatil7925 2 жыл бұрын

@@BIConsultingPro Thanks.