Question

You manage a Power BI semantic model containing a Sales fact table and a SalesRep dimension table that includes an Email column matching each rep's Microsoft Entra sign-in address. Company policy requires that each of the 400 sales reps see only the rows for their own sales when viewing a published report, and management wants to avoid creating and maintaining a separate security role for every individual rep. What is the most efficient way to implement this requirement?

Accepted Answer

Create a single RLS role with the DAX filter [Email] = USERPRINCIPALNAME() on the SalesRep table and assign all reps to that role.

Answer

Create 400 separate RLS roles, one per rep, each with a static filter on the rep's email, and assign each rep to their own role.

Answer

Assign each sales rep the Viewer workspace role and rely on workspace permissions to restrict their data.

Answer

Apply a sensitivity label to the report so that only the owning rep can open it.