Row-Level & Object-Level Security

Data-level security

Simple explanation

Think of a hospital records system. A nurse on cardiology sees heart patient records (row-level). The billing team sees billing columns but not clinical notes (column-level). Nobody knows the drug trial table exists (object-level).

Row-Level Security (RLS)

RLS filters rows based on user identity using a security mapping table:

-- Role: RegionalAccess — filter on dim_store
[Region] IN
    SELECTCOLUMNS(
        FILTER(SecurityMapping, SecurityMapping[UserEmail] = USERPRINCIPALNAME()),
        "Region", SecurityMapping[Region]
    )

CLS vs OLS

CLS hides data; OLS hides the existence of data
Feature	Column-Level (CLS)	Object-Level (OLS)
Data visible?	No — returns blank/restricted	No — column/table hidden from metadata entirely
Column in field list?	Yes — users know it exists	No — users do not know it exists
Measures referencing it	Return blank for restricted users	FAIL for restricted users
Configuration	Tabular Editor / XMLA	Tabular Editor / XMLA

Question

What is RLS?

Click or press Enter to reveal answer

Answer

Row-Level Security filters rows based on user identity. Uses USERPRINCIPALNAME() and a security mapping table. Same report, different data per user.

Click to flip back

Question

What is the difference between CLS and OLS?

Click or press Enter to reveal answer

Answer

CLS hides column DATA but column still exists in metadata. OLS hides column/table from metadata entirely — users do not know it exists. OLS is stricter: measures referencing OLS objects fail.

Click to flip back

Knowledge Check

Dr. Sarah needs cardiology doctors to see only cardiology patients. How?

Question

What does the USERPRINCIPALNAME() function do in RLS?

Click or press Enter to reveal answer

Answer

Returns the email address (UPN) of the current user querying the report. Used inside DAX filter expressions to dynamically match the logged-in user against a security mapping table, so each user sees only their permitted rows.

Click to flip back

Knowledge Check

Raj needs to hide a Salary column in a semantic model so non-HR users do not even know the column exists. Which security feature should he use?

Next up: Sensitivity Labels & Endorsement