Why RLS protects sensitive data in Power BI - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does Row-Level Security (RLS) restrict data access?

Imagine a sales report where each salesperson should only see their own sales data. How does RLS ensure this?

A RLS filters data at the row level based on user identity, showing only allowed rows.

B RLS encrypts the entire dataset so only authorized users can decrypt it.

C RLS hides columns with sensitive data but shows all rows to everyone.

D RLS duplicates data for each user to separate databases.

💡 Hint

Think about how data visibility changes depending on who is logged in.

RLS works by filtering rows dynamically based on the user's identity, so each user sees only the data they are permitted to view.

🎯 Scenario

intermediate

Scenario: Protecting sensitive employee data with RLS

Your company wants managers to see only their team's salary data, not others'. How can RLS help?

A Duplicate the employee table for each manager with only their team's data.

B Create RLS roles that filter employee rows by manager ID matching the logged-in user.

C Use RLS to hide the salary column for all users except HR.

D Disable RLS and rely on manual report sharing.

💡 Hint

Consider how to filter rows so managers see only their team's data.

By creating RLS roles that filter rows where the manager ID matches the logged-in user, managers see only their team's salary data.

❓ dax_lod_result

advanced

DAX expression effect under RLS

Given this DAX measure:
Total Sales = SUM(Sales[Amount])
and RLS filters Sales by Region for each user, what does Total Sales show?

A Sum of sales for all regions regardless of RLS.

B Sum of sales for regions not visible to the user.

C Sum of sales only for the regions visible to the logged-in user.

D Zero, because RLS blocks all sales data.

💡 Hint

Remember RLS filters data before measures calculate.

RLS filters the Sales table rows before the measure sums amounts, so only visible regions' sales are included.

🔧 Formula Fix

advanced

Why does this RLS filter not work as expected?

RLS rule: [Region] = USERPRINCIPALNAME()
User's email is '[e-mail]', but no data shows. Why?

A The filter syntax is invalid and causes a syntax error.

B USERPRINCIPALNAME() returns the user's email, which matches Region values correctly.

C RLS filters require numeric columns, so text columns cause errors.

D The Region column contains region names, not user emails, so the filter never matches.

💡 Hint

Check if the filter compares compatible values.

The filter compares Region (like 'North') to the user's email, so no rows match and no data shows.

❓ visualization

expert

Designing a dashboard with RLS for multiple user roles

You must create a Power BI dashboard where sales reps see only their sales, managers see their team's sales, and executives see all sales. How should you design RLS roles and visuals?

A Create RLS roles with filters: reps filter by USERNAME(), managers filter by team membership, executives have no filter; use role-based page navigation.

B Create one RLS role filtering all data by region; use slicers to let users pick their view.

C No RLS needed; share separate dashboards manually for each role.

D Use RLS to hide columns instead of rows; show all sales but mask sensitive fields.

💡 Hint

Think about how to apply different filters per role and control access.

Different RLS roles with appropriate filters ensure each user sees only their allowed data. Role-based page navigation can enhance user experience.

Practice

1. What is the main purpose of Row-Level Security (RLS) in Power BI?

easy

A. To speed up data refresh times

B. To change the visual design of the report for each user

C. To create new calculated columns automatically

D. To restrict data access by filtering rows based on the user's identity

Solution

1. Step 1: Understand RLS functionality

   RLS filters data rows so users only see data they are allowed to access.

2. Step 2: Compare options

   Speeding up refresh times, changing visual design, and creating calculated columns describe unrelated features; only restricting data access by filtering rows based on user identity matches RLS purpose.

3. Final Answer:

   To restrict data access by filtering rows based on the user's identity -> Option D

4. Quick Check:

   RLS filters rows by user identity = C [OK]

Hint: RLS controls data visibility per user, not report design [OK]

Common Mistakes:

• Confusing RLS with report formatting
• Thinking RLS speeds up data refresh
• Believing RLS creates new columns

2. Which of the following is the correct way to define a filter in a Power BI RLS role?

easy

A. FILTER('Sales', 'Sales'[Region] = "USERNAME()")

B. FILTER('Sales', 'Sales'[Region] == USERNAME())

C. FILTER('Sales', 'Sales'[Region] = USERPRINCIPALNAME())

D. FILTER('Sales', 'Sales'[Region] = USERNAME())

Solution

1. Step 1: Identify correct DAX function for user identity

   USERPRINCIPALNAME() returns the logged-in user's full username, commonly used in RLS filters.

2. Step 2: Check syntax correctness

   FILTER('Sales', 'Sales'[Region] = USERPRINCIPALNAME()) uses correct syntax and function. Using double equals (==), treating the function as a string, or using USERNAME() instead misuses syntax or less preferred function.

3. Final Answer:

   FILTER('Sales', 'Sales'[Region] = USERPRINCIPALNAME()) -> Option C

4. Quick Check:

   Use USERPRINCIPALNAME() for RLS filters = A [OK]

Hint: Use USERPRINCIPALNAME() for user-based filters in RLS [OK]

Common Mistakes:

• Using USERNAME() instead of USERPRINCIPALNAME()
• Using double equals (==) in DAX
• Putting USERNAME() inside quotes

3. Given this RLS filter on the 'Sales' table:
FILTER('Sales', 'Sales'[Salesperson] = USERPRINCIPALNAME())
If the logged-in user is '[e-mail]', what data will Alice see?

medium

A. All sales data regardless of salesperson

B. Only sales where 'Salesperson' equals '[e-mail]'

C. No data because USERPRINCIPALNAME() is invalid

D. Sales data for all salespersons except '[e-mail]'

Solution

1. Step 1: Understand the filter condition

   The filter keeps rows where 'Salesperson' matches the logged-in user's email.

2. Step 2: Apply the filter for user '[e-mail]'

   Only rows with 'Salesperson' = '[e-mail]' remain visible to Alice.

3. Final Answer:

   Only sales where 'Salesperson' equals '[e-mail]' -> Option B

4. Quick Check:

   RLS shows user-specific rows = B [OK]

Hint: RLS filters rows matching logged-in user exactly [OK]

Common Mistakes:

• Assuming all data is visible
• Thinking USERPRINCIPALNAME() is invalid
• Believing data for other users is shown

4. You created this RLS role filter:
FILTER('Orders', 'Orders'[Country] = USERNAME())
But users report seeing no data. What is the most likely issue?

medium

A. USERNAME() returns only the username, not the country name

B. FILTER function is not supported in RLS roles

C. The table name 'Orders' is misspelled

D. RLS roles cannot filter by text columns

Solution

1. Step 1: Understand USERNAME() output

   USERNAME() returns the user's login name, not a country name.

2. Step 2: Compare USERNAME() with 'Country' column

   Since 'Country' contains country names, the filter never matches, so no data shows.

3. Final Answer:

   USERNAME() returns only the username, not the country name -> Option A

4. Quick Check:

   Mismatch between USERNAME() and column values = A [OK]

Hint: Match USERPRINCIPALNAME() or correct user info to column values [OK]

Common Mistakes:

• Assuming USERNAME() returns country
• Thinking FILTER is unsupported in RLS
• Ignoring case sensitivity in filters

5. You want to protect sensitive sales data so that each regional manager sees only their region's data. Which approach best uses RLS to achieve this?

hard

A. Create a role with filter 'Sales'[Region] = LOOKUPVALUE('Managers'[Region], 'Managers'[Email], USERPRINCIPALNAME()) and assign managers by email

B. Do not use RLS; instead, create separate reports for each region

C. Create a role with filter 'Sales'[Region] = "Region1" and assign all managers to this role

D. Create a role with filter 'Sales'[Region] = USERPRINCIPALNAME() and assign managers their email as region

Solution

1. Step 1: Understand the need for dynamic filtering

   Each manager should see data for their assigned region, which may differ from their username.

2. Step 2: Use LOOKUPVALUE to map manager email to region

   Create a role with filter 'Sales'[Region] = LOOKUPVALUE('Managers'[Region], 'Managers'[Email], USERPRINCIPALNAME()) and assign managers by email uses LOOKUPVALUE to find the manager's region from a 'Managers' table, enabling correct filtering.

3. Step 3: Evaluate other options

   Create a role with filter 'Sales'[Region] = USERPRINCIPALNAME() and assign managers their email as region incorrectly assumes email equals region; C assigns all managers to one region; B avoids RLS and is less efficient.

4. Final Answer:

   Create a role with filter 'Sales'[Region] = LOOKUPVALUE('Managers'[Region], 'Managers'[Email], USERPRINCIPALNAME()) and assign managers by email -> Option A

5. Quick Check:

   Use LOOKUPVALUE for dynamic RLS filtering = D [OK]

Hint: Use LOOKUPVALUE to map users to their data dynamically [OK]

Common Mistakes:

• Assuming username equals region directly
• Assigning all users to one static region
• Avoiding RLS and duplicating reports