Glossary
What is row-level security (RLS)?
Row-level security (RLS) is a security feature that determines per user which rows of data are visible. In Power BI, you define RLS in roles with DAX filters, so that a regional manager, for example, only sees their own region.
Row-level security (RLS) explained
With static RLS you create a role per group with a fixed filter, such as Region = "North". With dynamic RLS a single role uses the user's identity, for example with USERPRINCIPALNAME() or CUSTOMDATA(), and the model looks up in a table which data belongs to that person. Dynamic RLS scales better when you have many users.
RLS restricts rows, not columns or pages. If you want someone not to see an entire report, you handle that through access to the report itself. For columns, Power BI has object-level security, which works differently.
Always test RLS with "view as role" or as a real user. And check what happens when someone has no role: when embedding, the report should then show nothing, not all data.
Example
Acme Groothandel has branch managers in four regions. One role filters the branch table on the signed-in manager's region code, so the manager for the North sees only the North in the same report, while the board sees everything without a filter.
Row-level security (RLS) in ENABLE
In ENABLE you link access profiles or a user tag to Power BI roles, optionally using CUSTOMDATA(). A user without a tag gets no access; there is no fallback to unfiltered data. RLS is off by default and is switched on per customer.
FAQ
Frequently asked questions
What is the difference between static and dynamic RLS?
Static RLS uses a fixed filter value per role, while dynamic RLS filters based on who is signed in. Dynamic RLS needs fewer roles and scales better with many users.
Does row-level security work with Power BI Embedded?
Yes. When requesting the embed token, the application passes a username, role and optionally a CUSTOMDATA value, and the semantic model applies the role filters.
Can RLS also hide columns?
No, RLS only filters rows. To hide tables or columns you use object-level security, or you create a separate report.
Further reading
- ResourcesRow-level security in Power BI explainedRow-level security (RLS) in Power BI is a security layer in the semantic model that determines which rows of data a user gets to see. Everyone opens the same report, but a regional manager only sees their own region and a customer only their own orders. You define RLS in roles with DAX filters: static with fixed values, or dynamic based on who is viewing.Read more
- PlatformPower BI row-level security and dashboard accessAccess profiles, Power BI row-level security, two-factor authentication and an audit log.Read more
- ResourcesShare Power BI dashboards securely: your optionsYou can share a Power BI dashboard in four ways: Publish to web, sharing in the Power BI service (directly or through an app), inviting external users as B2B guest users, or showing the reports in a portal with Power BI Embedded. For colleagues, the Power BI service is usually enough. To share Power BI dashboards securely with customers, suppliers and other external users, guest users or a customer portal are the right choice; Publish to web is public and never suitable for business data.Read more
- SolutionPower BI dashboard portal: share dashboards securelyShare your Power BI dashboards securely in your own portal, with role-based access.Read more
Use AI on your own data. Securely, and without the headache.
In an online demo we show how ENABLE makes your data securely available and how you build on it: describing an app in the AI Builder, plain-language questions, dashboards and APIs. And how we set it up and manage it for you.