How to Set Up Row-Level Security in Power BI
To set up RLS in Power BI, open Modeling in Power BI Desktop, click 'Manage roles', create a role, and add a DAX filter expression on the relevant table. Test the role using 'View as'. After publishing to the Power BI Service, go to the dataset settings and assign users or security groups to each role. For dynamic RLS, use the USERPRINCIPALNAME() function in your DAX filter instead of a hardcoded value.
Set up Row-Level Security in Power BI to give each user access to only their own data, using roles and DAX filters in Power BI Desktop and the Service.
Row-Level Security lets you share one report with your whole team while ensuring each person sees only the data they are allowed to see. The setup takes place in two steps: define roles in Power BI Desktop, then assign users in the Power BI Service.
Before you start, make sure your data model has a column you can filter on, such as a Region, Department, or SalesRep column. If you want dynamic RLS, you also need a user mapping table that links email addresses to the values in that column.
Step 1: Create a Role in Power BI Desktop
Open your report in Power BI Desktop, go to the Modeling tab, and click Manage roles. In the role manager, click Create and enter a name for the role. Then select the table you want to filter from the list on the left. In the filter field that appears, enter your DAX expression. For a static filter, this might look like: [Region] = "West". For dynamic RLS, use: [UserEmail] = USERPRINCIPALNAME(). Click the checkmark to confirm the filter, then click Save.
Step 2: Test the Role Before Publishing
Still in Power BI Desktop, go to the Modeling tab and click View as. Select the role you just created. The report immediately applies the filter so you can check whether the correct rows are visible. If you are using dynamic RLS, enter a test email address in the “Other user” field to simulate a specific person. Confirm that all visuals show the expected data and that no rows from other groups leak through. Fix any issues in the DAX filter before continuing.
Step 3: Publish to Power BI Service
When your roles are working correctly, publish the report to a Power BI workspace as you normally would. See How to Publish a Power BI Dashboard for the publishing steps. The roles you defined in Desktop are bundled with the dataset and become available in the Service automatically.
Step 4: Assign Users to Roles in the Service
In the Power BI Service, navigate to the workspace and find your dataset. Click the three-dot menu next to it and choose Security. You see the roles you defined in Desktop listed on the left. Click a role, then type the email address or security group name you want to assign to it. Click Add, then Save. Repeat for every role. Users will now see filtered data the next time they open the report.
Step 5: Verify with the Test Feature in the Service
After assigning users, verify the setup by clicking Test as role in the dataset security settings. This shows the report as a specific role would see it, confirming that the Service-side assignment works correctly. Also ask a colleague who has been assigned a role to open the report and confirm their view. For more background on what RLS does, see What is Row-Level Security in Power BI?
Our tip: Always use Azure Active Directory security groups instead of individual email addresses when assigning users to roles. When someone joins or leaves the team, updating the security group is enough; you never need to touch the Power BI security settings again.
Frequently asked questions
How do I test RLS without publishing to the Power BI Service?
Use the 'View as' feature in Power BI Desktop. Go to the Modeling tab and click 'View as'. Select one of your roles, and optionally enter a specific username to simulate dynamic RLS. The report refreshes to show only the data that role can access. This lets you verify your DAX filters before publishing, which saves time and avoids exposing incorrect data to users.
Can I assign a security group instead of individual users to an RLS role?
Yes. In the Power BI Service, when you open the Security settings for a dataset, you can enter either individual email addresses or Azure Active Directory (Entra ID) security group names. Using security groups is strongly recommended for larger organisations because adding or removing a user from the group automatically updates their RLS access without any changes needed in Power BI.
What happens if a user is not assigned to any role?
If a user has access to the report but is not assigned to any RLS role, they see all data with no row-level filter applied. This is a common mistake: forgetting to assign a user means they bypass RLS entirely. Always assign every user to at least one role, or use a catch-all role with a filter that returns no rows for unrecognised users.
Does RLS slow down my report?
RLS adds a filter to every query, which has some performance impact. For Import mode, the impact is usually minimal because data is already in memory. For DirectQuery, the RLS filter is added to every SQL query sent to the source, so ensure the filtered columns are indexed in your database. Dynamic RLS with a USERPRINCIPALNAME() lookup requires a relationship join on every query, so keep your user mapping table small and well-indexed.