Question

You manage a shared semantic model in a Fabric workspace that serves a sales report used by hundreds of regional managers. Each manager must see only the rows for their own region without you creating a separate role for every person. A dimension table named DimManager contains a column called UserEmail that maps each manager's email to their assigned region. You need to configure row-level security (RLS) so that filtering is applied automatically based on the identity of the user viewing the report. Which approach should you use?

Accepted Answer

Create a single RLS role with a DAX filter on DimManager using [UserEmail] = USERPRINCIPALNAME(), then assign all managers to that one role.

Answer

Create one static RLS role per region with a hard-coded filter such as [Region] = "East", and assign each manager to the matching role.

Answer

Apply object-level security to hide the DimManager table from all managers so they cannot see other regions.

Answer

Enable a sensitivity label on the semantic model so that each manager sees only their region's data.