Static RLS rules in Power BI - Step-by-Step Guide

Introduction

Static Row-Level Security (RLS) rules let you control which rows of data each user can see in a Power BI report. This helps keep sensitive data safe by showing only the right data to the right people.

When you want to restrict sales data so regional managers see only their region's sales.

When you need to hide employee salary details from all but HR staff.

When your report should show different product lines to different product managers.

When you want to create a single report but show personalized data views based on user roles.

When you want to prevent users from seeing data outside their department.

Steps

Step 1: Open

- Power BI Desktop

Your report file loads and shows the data model and report canvas

Step 2: Click

- Model view icon on the left side

You see tables and relationships in your data model

Step 3: Select

- Table where you want to apply RLS (e.g., Sales)

The table is highlighted and its columns are visible

Step 4: Click

- Modeling tab on the ribbon, then Manage Roles button

The Manage Roles window opens where you can create security roles

Step 5: Click

- Create button in Manage Roles window

A new role is added with a default name (e.g., Role1)

Step 6: Type

- Role name field

The role is renamed to something meaningful like 'RegionManager'

Step 7: Click

- Table name under the role

You can enter a DAX filter expression to limit rows

Step 8: Type

- Filter expression box

The filter is applied to the table for this role, e.g., [Region] = "West"

💡 Use simple DAX expressions that return TRUE or FALSE to filter rows

Step 9: Click

- Save button in Manage Roles window

The role is saved and ready to be tested

Step 10: Click

- Modeling tab, then View as Roles button

You can select the role to see the report as that role would see it

Before vs After

Before

Report shows all sales data for all regions to every user

After

Report shows only sales data for the West region to users assigned to the 'RegionManager' role with filter [Region] = "West"

Settings Reference

Manage Roles

📍 Modeling tab on the ribbon

Create and manage static RLS roles with row filters

Default: No roles defined

View as Roles

📍 Modeling tab on the ribbon

Preview report data as a user with a specific role

Default: No role selected

Common Mistakes

Using dynamic user functions like USERNAME() inside static RLS roles without proper setup

Static RLS roles do not automatically filter by user identity; USERNAME() requires dynamic RLS setup

Use fixed filter expressions for static roles or set up dynamic RLS with USERNAME() in the filter

Not testing roles with 'View as Roles' after creating them

You might not realize the filter is incorrect or too broad/narrow

Always use 'View as Roles' to confirm the data visible matches your expectations

Summary

Static RLS rules restrict data rows for users based on fixed filters you define.

You create roles and assign simple filter expressions to tables in Power BI Desktop.

Remember to test roles using 'View as Roles' to ensure correct data visibility.