SF logo
Power BI toolkit

RLS Role Generator

Describe who should see which rows, and get the TMDL script that adds the row-level security roles to your model, a query that tests them, and a check of which tables each role actually restricts. No AI needed.

Step1

Your model export

The page lists your tables and columns from it, checks every name, and follows your relationships to see where each role’s filter reaches.

The model export query (the same one the other toolkit pages use)
  1. In Power BI Desktop, open DAX query view, paste this query and select Run.
  2. Above the results grid, select Copy, then paste below.
DAX query: model export

          

        

      

      
      

      

    

  


  
  

    
Step2

    

      

        
Set up the roles

        
Each role is a group of people who see the same slice of data. Add rules to say which rows they see; rules on different tables all apply. A role with no rules sees everything.

      

      

        Which kind of rule?
        

          
    
            
  • Fixed values: everyone in the role sees the same rows, such as Region is West. One role per region, team or country.
    • 
            
  • User’s own rows: a column holds each person’s sign-in email (a sales rep on each customer, say), and people see the rows with their email. One role covers everyone.
    • 
            
  • Access table: a separate table lists who may see what (Email and Region, one row per pair). One role covers everyone, and access changes by editing the table, not the model.
    • 
            
  • Custom DAX: any TRUE/FALSE expression for each row of a table. FALSE () hides the whole table from the role.
    • 
          

        

      

      

      

    

  


  
  

    
Step3

    

      

        
Script and test

        
Add the roles in TMDL view, check them with the test query, then assign people in the Power BI service.

      

      

      

        

          
TMDL script: roles

          

        

        

          
Add the roles

          
    
            
  1. Save a copy of the report first. In Power BI Desktop, open TMDL view, paste the script into a new tab and select Apply. A role with the same name is replaced.
    2. 
            
  2. Check each role with Modeling > View as. For user-based rules, tick Other user and type a person’s sign-in email.
    3. 
          

        

        

        

          
DAX query: rows each role sees

          

        

        

          
After you publish

          
    
            
  1. In the Power BI service, open the semantic model’s … menu > Security, pick each role and add people or security groups. Groups are easier to keep up to date.
    2. 
            
  2. Roles only restrict people with the Viewer role in the workspace, or who get the report through an app or a share. Workspace Admins, Members and Contributors see all the data.
    3. 
            
  3. Use Test as role on the same Security page to check a real person’s view before you tell people the report is ready.
    4.