Row Level Security (RLS)

What is Row Level Security (RLS)?

Row Level Security is a Microsoft feature, used in Power BI reporting and SQL Server, that restricts data access at the row level rather than hiding entire tables or reports. Two people can open the exact same dashboard and see completely different data, because the system filters rows based on the logged-in user's identity.

• Works in both Power BI datasets and SQL Server databases.
• Filters happen automatically, without building separate reports per user.
• Applies whether the user connects through a browser, app, or direct query.

How It's Set Up

RLS runs on roles and filters rather than manual permissions per person.

• Create a role, like "Regional Manager" or "Sales Rep".
• Define a filter, usually a DAX expression in Power BI, that limits rows to a condition like Region = USERPRINCIPALNAME().
• Assign users to that role, either individually or through a security group.
• Publish, and the same report now shows different data automatically depending on who's viewing it.

There are two common approaches: static RLS, where filters are hardcoded to fixed values, and dynamic RLS, where filters reference the logged-in user directly, so one role definition works for hundreds of people without rebuilding anything.

Why Companies Use It

Without RLS, teams either build separate reports for every department or trust everyone to only look at what applies to them. Neither holds up well past a certain company size.

• One report instead of a dozen near-identical copies.
• Sensitive data (salaries, regional sales, client details) stays restricted without extra effort.
• Easier to stay compliant when access control is built into the Data Management layer, not left to trust.

Frequently Asked Questions

Does Row Level Security work outside Power BI?

Yes. RLS is available in SQL Server and Azure SQL Database as well, using security policies instead of DAX filters, so the same row-level control extends beyond just reports.

Can one user belong to multiple roles?

Yes, and when they do, Power BI combines the roles using OR logic, meaning the user sees the union of rows allowed by each role, not just the most restrictive one.