Create RLS roles and assign group members in Power BI Desktop.

Row-Level Security (RLS) lets you restrict data access so users only see what they’re allowed. In Power BI Desktop, you create roles with filters and assign users or groups to them. Once published, these rules control what each user sees in the report.

*
1. In Power BI Desktop, open the Modeling tab and select Manage Roles.

*

2. Create a role that allows viewing only the data related to Arizona.

• Create a new role and name it Arizona.

*

3. Create a new rule.

• In the right-hand Rules column, click the + New button
• A drop-down will appear.
• Select the column name that contains your states (e.g., "State").
• In the next box, leave the operator as Equals.
• In the value box, type Arizona.
• Click the green Save button at the bottom right.

Note: You created the role (the logic: "Only show Arizona"), and now you assign users (the people) to it. It allows you to share one report with the whole company while ensuring each person only sees the data relevant to them.

*

4. Publish this configuration to your workspace.

*

5. Once saved, you should verify it works. Go back to your report, select the Modeling tab, and click View as. Select your new Arizona role. If everything is correct, all your charts should suddenly update to show only Arizona data.

*

*

5. Once you set up a role, you can assign the role to users or groups in Power BI Service.

• Go to the workspace where you published the report.
• Find the Semantic Model (the one with the orange icon).
• Click the three dots (...) next to the name and select Security.

*

6. Add Your Users

You will see a list of roles on the left.

Click on your Arizona role.

In the "Members" box on the right, type the email addresses, security groups, or distribution lists for the people who should only see Arizona data.

• Click Add, then click Save, and then add and save again.

*

7. Test this role.

Click the three dots next to the Arizona role to test as a role.

*

*

Important:

The "Viewer" Role: Users must be added to the Workspace as Viewers. If you add someone as an Admin, Member, or Contributor, they have "Edit" permissions. Power BI assumes editors need to see all data to fix the report, so it ignores RLS for them.

Organizational Email: You can only add users within your organization (or guest users already in your Entra ID/Active Directory).

*

Grant users or groups access to the dataset.

After setting up your reports and RLS roles, you need to give users or groups access to the dataset in Power BI Service. This ensures they can view, interact with, and use the reports and dashboards you’ve created.

Benefits:

• Controlled Access: Only authorized users can see or interact with the data.
• Collaboration: Teams can work with the same dataset without duplicating it.
• Security Compliance: Helps maintain data privacy and enforces RLS rules effectively.

1. Go to your project.

• Click update app.

*

2. Go to the audience tab.

App Audiences in Power BI allows you to control exactly who sees what when you publish your reports as an "App" for the rest of your company.

*

Explanation:

Grant Access To

• Specific users or groups: This is where you type in the email addresses of the people who should have access to this specific "Audience" (e.g., the Arizona team).
• Entire organization: Choosing this makes the app visible to everyone in your company.

Advanced Settings

• These two checkboxes give your users "Super User" powers over the underlying data:
• Allow people to share the datasets: If checked, users in this audience can "reshare" the raw data with others outside the app.
• Allow people to build content: this gives them build permission. They can use your semantic model to create their own separate reports in their own workspaces.

Workspace Users Warning

• The yellow box is a reminder that Workspace Users (like "John Smith" shown at the bottom) are the admins/owners.
• Because John Smith is a workspace user, he will always have access to everything in the app, regardless of what audience settings you choose.
• You cannot restrict John's view using these audience toggles; you'd have to remove him from the workspace itself to do that.

*

3. The "Manage Permissions" page is the central hub for Direct Access. Here is the simplest way to think about how this differs from the App Audience settings we discussed earlier:

Direct Access (manage permissions)

• What it is: Permanent, item-level permission. It’s like giving someone a physical key to a specific room (a report or a model).
• When to use it: When you want to share one specific item with a colleague without them needing to install an entire App.

Key Detail: As you can see with "John Smith," it shows his permissions were granted via the App. This screen "sees" everything, regardless of how the person got access.

App Audience (The Previous Screen)

• What it is: A "Front Door" for a collection of reports. It’s like a hotel lobby where you decide which group of guests can see which floors.
• When to use it: For formal distribution to a large group of "end users." It provides a cleaner, more professional interface than sharing direct links.

*

*

4. Roles can also be assigned from the Manage Permissions page.

Note: To remove access, use the three-dot menu beside the user.

*

*

Roles

Description of the roles you can assign to a Power BI workspace:

Admin – Full control over the workspace. Can add or remove members, change roles, manage workspace settings, and publish or delete content. Essentially the owner of the workspace.

Member – Can create and edit reports, publish apps and content to the workspace, and share reports and dashboards. Cannot manage workspace settings or users.

Contributor – Can create and edit content (reports, dashboards, datasets), publish and update reports, edit datasets, and delete content they own (dashboards). Cannot add or remove users, change workspace settings, or publish apps/share dashboards.

Viewer – Read-only access. Can view reports and dashboards but cannot create, edit, or publish content.

*

Conclusion:

By following these steps, you will have a fully configured Power BI environment that is secure, collaborative, and insight-driven. Users can interact with dashboards, receive timely alerts, and view only the data they are authorized to access. Implementing these practices ensures better data governance, improved decision-making, and a consistent experience across reports, dashboards, and mobile devices.

*

Written by Kirill.A - Azure & Cybersecurity Consultant at AntusNet