Power BI — Object Level Security

Everyone who works with Power BI has heard or used an Row Level Security. But not everyone knows that Power BI offers an OLS — Object Level Security. If you want to restrict an access to a particular object like a table or a column. You can use this functionality. As of today, you have to use Tabular Editor to implement the OLS. There is no option to implement it through the Power BI Desktop/Service UI.

At the beginning, I’ve created a model containing two identical tables, two measures and two visualizations. Each of measures and visualizations uses a different table.

The second step is to create a Role where we apply the OLS.

In Tabular Editor, lets restrict an access to the entire table. In order to do this, you need to select a role. Afterwards, in the Security section -> select a table inside a Table Permissions subsection, and then select “None”.

Once you saved changes and selected a Role in PBI Desktop (View as roles).

The second visualization is useless. Why? The restricted table is invisible from a model standpoint, theoretically it doesn’t exist in the model for this particular group (Restricted OLS).

Let’s assume that we want to restrict an access to two columns, not an entire table.

Expand a Tables folder, do the same with a table. Pick a column which you want to hide. In the Object Security Section change the state to “None”.

After the model has been saved. You are no longer able to see affected columns. In this case the [ID] and the [Invoice_Item_Number].

After the report is deployed to the Power BI Service, you can add users or groups who should belong to the restricted group. A configuration is performed in the Dataset Security section.