
Data security is of paramount importance in any data-centric organization, and Power BI, Microsoft’s business analytics tool, offers robust data security measures. Two powerful features that significantly enhance Power BI data security are Row-Level Security (RLS) and Data Masking. This blog post will provide a deep dive into these two mechanisms and show practical code samples to help you better understand their implementation.
Row-Level Security (RLS)
RLS is a Power BI feature that controls data access at the row level based on user roles and their filters. It’s a versatile security strategy that allows different data access levels within the same report for different users. For instance, a regional manager can only access data related to their own region, while a salesperson can only see data related to their specific customers.
To implement RLS, follow the steps:
- Create roles and define filters: In Power BI Desktop, navigate to the
Modelingtab and click onManage Roles. Here, you can define roles and set up row-level filters. For example, to create a role for a salesperson, click onCreateand type the role name, such asSalesperson. Select the table you want to apply the filter to, write the DAX expression that defines the filter condition, and then clickSave.
Example DAX expression for salesperson role:
[SalespersonName] = USERPRINCIPALNAME()
In this case, the salesperson can only see the rows where their name matches their user principal name.
- Test your roles: After creating roles and defining filters, you can check how the data appears for each role. Click on
View As Roleson theModelingtab, select the role you want to view, and see how the data changes in the report view. - Publish the report and assign roles in Power BI Service: Once the report is ready, publish it to Power BI Service. Here, you can assign roles to users. Go to the dataset settings, select
Security, and assign roles to users or groups. Remember that you need to have admin permissions to assign roles.
Please note that RLS does not apply to users with admin, member, or contributor roles in workspace access.
Data Masking
Data masking is a technique used to protect sensitive data by replacing it with fictitious data. This strategy is especially helpful when you need to hide specific data but the dataset’s overall structure is necessary.
Unfortunately, as of my knowledge cutoff in September 2021, Power BI does not directly support data masking. However, you can achieve similar results using DAX functions or Power Query transformations.
Using DAX
Create a calculated column with the DAX IF function to hide sensitive data. For example, if you want to mask the email addresses of your customers, you could use the following DAX expression:
Email Masked = IF([Role]="Salesperson", [Email], "*****")
In this example, if the user role is “Salesperson,” the email will be displayed. Otherwise, it will display asterisks.
Using Power Query
Power Query can also be used to mask data. For example, to mask the last four digits of a phone number:
- Go to
Edit Queriesin Power BI Desktop. - Select the column with the phone numbers.
- From the
Add Columntab, selectCustom Column. - Write a formula to mask the data.
Power Query = Text.Start([Phone], Text.Length([Phone]) - 4) & "****"
This formula will show the beginning of the phone number and replace the last four digits with asterisks.
Data security is an ongoing process and must be a priority in any organization. Row-Level Security and Data Masking are two strategies that can significantly improve your data security in Power BI. Though Power BI might not directly support data masking, creative use of DAX and Power Query can help achieve similar results.
Remember, data protection doesn’t stop at implementing security measures. Regular audits and reviews should be part of your data security strategy to ensure these measures are always up-to-date and effective.
This blogpost was created with help from ChatGPT Pro








