How can I set up Dynamic Row-Level Security so users only see their own department data?

All answers to this question.

Dynamic RLS is the most efficient way to handle this. You definitely need a "Security Mapping" table that has two columns: the Department Name and the User Email (as it appears in Azure AD). In Power BI Desktop, go to "Manage Roles," create a role, and apply a DAX filter to your security table like: [UserEmail] = USERPRINCIPALNAME(). Then, make sure there is a relationship between your security table and your main data table. When the report is published to the Service, Power BI will detect the logged-in user and filter the entire dataset based on that relationship.

   Answered 2025-06-07 by Martha Bradley

What happens if a manager needs to see two departments? Does your mapping table handle multiple entries for a single email address?

   Answered 2025-06-08 by Kevin Malone

• Kevin, that's exactly where most people fail! Cynthia, to handle that, your mapping table should be in a "many-to-one" relationship with your user list. If I’m in the table twice with two departments, RLS will correctly show me both. Just remember that RLS doesn't work for users with "Edit" permissions in the workspace—they will always see everything. You have to test the roles using the "View as" feature in the Service to be 100% sure.

     Commented 2025-06-09 by Jason Perry

Don't forget to add the users to the Role in the Power BI Service after you publish! Defining the DAX in Desktop is only half the battle; you have to assign people to it online.

   Answered 2025-06-10 by Gary Simmons

• Great reminder, Gary. I spent three hours once wondering why my security wasn't working, only to realize I hadn't added the "All Staff" group to the security role in the portal!

     Commented 2025-06-11 by Martha Bradley