What Is Row-Level Security in Power BI? A Plain-English Guide
The Same Report, Different Data for Different People
Imagine a sales report that shows revenue by region. You want the national director to see all regions. You want each regional manager to see only their own.
You could build separate reports for each person. But that means maintaining five, ten, or twenty versions of the same report every time the data model changes.
Row-Level Security exists to solve exactly this. One report, one dataset, different data for each person based on who they are.
What Row-Level Security Is
Row-Level Security, usually shortened to RLS, is a feature that filters the data a user sees inside a Power BI report based on their identity.
The filter is applied at the data level, not the visual level. That means the chart, the table, and any card visuals all reflect the filtered data automatically. There is no manual step the user takes and no way for them to see data they are not supposed to see by clicking through visuals.
RLS is set up by a report or dataset administrator. Once it is in place, it runs silently in the background every time someone opens the report.
Static RLS vs Dynamic RLS
There are two main approaches to configuring RLS, and the right one depends on your setup.
Static RLS
With static RLS, you define a fixed rule for each role. For example, a role called ‘South Region’ might have a DAX filter that says Region = "South". Anyone assigned to that role sees only South data.
Static RLS is straightforward to set up and works well when your user groups are stable and small. The downside is that every new role needs to be created manually, and the list of roles is hardcoded in the model.
Dynamic RLS
Dynamic RLS uses the identity of the logged-in user to determine what they see. A common pattern is to have a table in your dataset that maps email addresses to regions, departments, or client IDs. When the user opens the report, the RLS filter looks up their email and applies the corresponding filter automatically.
This is more work to set up initially but scales much better. Adding a new user or changing their access is as simple as updating the mapping table, not modifying the dataset roles.
What RLS Looks Like in Practice
Here are a few common scenarios where RLS is the right tool:
| Scenario | What RLS Does |
| Sales report by region | Each regional manager sees only their region’s pipeline and revenue |
| Financial report by cost centre | Each department head sees only their cost centre’s budget and spend |
| Client-facing analytics | Each client sees only their own data, not other clients’ |
| HR report by team | Each people manager sees only their direct reports’ data |
| Franchise or partner network | Each franchisee sees only their own location’s performance |
How to Set Up RLS in Power BI
RLS is configured in Power BI Desktop, in the Modeling tab.
Step 1 — Define roles: Go to Modeling, then Manage roles. Create a role and write a DAX filter expression that determines what data that role can see. For example, = "South" or = USERPRINCIPALNAME() for dynamic RLS.
Step 2 — Test the role: Use the View As Roles feature to preview what the report looks like when viewed through a specific role. This is the most important step — always verify before publishing.
Step 3 — Publish and assign: Publish the report to Power BI Service. In the dataset settings, go to Security and assign users or groups to each role.
From that point on, RLS is active. Anyone who opens the report is filtered to the data their role permits, with no extra configuration needed.
Common RLS Mistakes to Avoid
- Testing only with your own account in the Power BI Service — workspace Admins, Members and Contributors are not filtered by RLS, so use View As Roles or a Viewer account. (This does not apply to PowerBI Portal or Robots, where the configured identity is always enforced.)
- Forgetting to assign users to roles in the Service — defining roles in Desktop without assigning them in Service means nobody gets filtered
- Using email addresses that do not match the login — in the Power BI Service returns the Microsoft account email; if your users log in differently, the match will fail
- Not refreshing the mapping table — if you use a dynamic RLS table, it only applies new access when the table is refreshed
RLS in PowerBI Portal and PowerBI Robots
Both PowerBI Portal and PowerBI Robots work directly with RLS configured in your dataset.
In PowerBI Portal, RLS uses the roles you defined in your dataset: you map them once on each report (per user or per group, with tokens), and from then on every user, including external users without a Power BI licence, sees only the data their role permits.
In PowerBI Robots, when the playlist is configured with Row-Level Roles and Row-Level User fields per recipient (using the #RECIPIENT_EMAIL# token for the mapping), each person in a distribution list receives a version of the report filtered to their data. Note that RLS-based delivery in Robots requires a service principal and a Premium or Embedded capacity.
In both cases, RLS does the filtering. The tools apply it.
Frequently Asked Questions
Can users bypass RLS?
No. RLS is applied at the dataset level, not the visual level. A user interacting with filters, slicers, or drill-through in a report cannot access data outside their RLS scope. The filter is enforced by the Power BI engine before the data reaches the visual.
Does RLS work with direct embed and portals?
Yes, as long as the embedding application passes an identity for the user. PowerBI Portal does this from the RLS settings of each report, which is what lets external users without a Microsoft account be filtered.
Does RLS affect performance?
It can, depending on how the rules are written. Complex DAX filters on large datasets may add some query time. For most use cases the impact is negligible. If performance is a concern, consider using DirectQuery with RLS-optimised table structures.
PowerBI Portal applies the Row-Level Security set up on your reports to every user, including external users with no Power BI licence. Start a free trial here.
Share this post:
