How do I handle Dynamic Row-Level Security for users across multiple departments?

All answers to this question.

The best practice for Dynamic RLS is to have a "Security Mapping" table that contains the email addresses and the Department IDs. You should create a 1-to-many relationship from the Security table to your Department Dimension table, and ensure the "Apply security filter in both directions" checkbox is selected. Then, in the RLS Role settings within Power BI Desktop, add a filter to the Security table: [Email] = USERPRINCIPALNAME(). This ensures that when a user logs in, the security table filters down to just their row, which then filters the dimension table, and finally the Fact table. It’s clean, scalable, and doesn't require hardcoding names.

   Answered 2025-07-12 by Patricia Higgins

Are you dealing with a "Many-to-Many" scenario where one manager might oversee three different departments at the same time?

   Answered 2025-07-25 by Thomas Wright

• Thomas, yes! Some of our directors have oversight of multiple business units. I was worried about how the relationship would handle that. Based on Patricia's advice, I think I just need multiple rows in my mapping table for those specific users. As long as the relationship is set up correctly, the filter should propagate for all the Department IDs associated with that director's email address. I’ll just need to be careful about the performance impact of "bi-directional" filtering on such a large model.

     Commented 2025-08-02 by Angela Davis

Always test your RLS roles in the Power BI Service using the "Test as Role" feature. What works in Desktop often behaves differently once published.

   Answered 2025-08-15 by Kevin Spacey

• Kevin is right. Testing in the Service is the only way to be 100% sure that your AD groups are correctly mapped to the RLS roles you've created.

     Commented 2025-08-20 by Patricia Higgins