Question

You manage a Fabric semantic model for the Finance team. The HR department must only see rows where the Department column equals 'HR', and this assignment never changes based on the logged-in user. You need to configure security so that all members of a security group mapped to a role see only HR data, while keeping the model as simple as possible. Which approach should you implement?

Accepted Answer

Create a static row-level security role with the DAX filter [Department] = "HR" and map the HR security group to that role

Answer

Create a dynamic row-level security role using USERPRINCIPALNAME() to look up each user's department in a mapping table

Answer

Apply object-level security to hide the Department column from the HR security group

Answer

Configure column-level security in the underlying warehouse to mask all non-HR rows