4 + 2 Security features in Power BI | by Salvatore Cagliari | Nov, 2022

By Jessie Hobb On Nov 25, 2022

I wrote an article on four security features in Power BI one year ago. In the meantime, we got some new Security features. Let’s investigate them.

Last year, on November 03, 2021, I wrote the following article:

Microsoft has added two new Security features in Power BI since then.

This is a good reason to return to this topic and update you.

In the Article mentioned above, I listed the following four security features of Power BI:

Privacy Levels in Power Query
Row Level Security (RLS) in Power BI
Office 365 Sensitivity Labels
Power BI Workspace Security

While I mentioned App Security in that article, Microsoft has added a new Feature to Apps: Audience.

In addition, Microsoft added Object Level Security in Power BI as well.

So, let’s look into these two features:

One important point when exploring the App Experience in Power BI Service is that creating more than one App per Workspace is impossible.

Adding another App to one Workspace would allow us to define which user can access which report from the Workspace.

The new feature Audience allows us to define access to the reports and the report pages within the App to a group of users.

First, you have to click on the “Create App” or “Update App” Button for your Workspace to jump to the functionality of editing an App.

Then, you can directly change to the Audience Tab:

Figure 1 — Go to the Audience Tab (Figure by the Author)

If you don’t see the Audience page, you must upgrade your App experience. You can see how to do it in the video linked below-

The existing Audience allows full Access to all Users.

Now, you can Add a new Audience to the App:

Figure 2 — Add a new Audience (Figure by the Author)

To configure access to each element of the App, you must click on the element. Then change the access list of it:

Figure 3 — Set access to the element in the App (Figure by the Author)

After setting up your new Audience, you can also change the access rights on the first (Default) Audience.

Watch the YouTube Video by Guy in a Cube in the References Section below for a detailed demo of how to work with this feature.

For this reason, I will not dig deeper into this feature.

But look at this excellent new feature, as it can revolutionize your work with Power BI Apps.

As the name suggests, we can use Object Level Security (OLS) to control access to the objects in a Power BI Data Model.

We have had OLS in Analysis Services Tabular since the beginning. But this is new for Power BI.

We can set OLS to Tables & Columns but not for Measures, Calculation Groups, or other objects.

But, when we restrict access to a table or column used by a Measure, access to the Measure is also restricted.

In the References Section below, you will find a link to an Article written by SQLBI on how to hide Measures with OLS.

OLS is another feature that can’t be leveraged solely in Power BI Desktop. You have to use Tabular Editor as well to use this feature.

First, you need to create a new Role in the Data Model.

You must create the Role in Power BI Desktop:

Figure 4 — Create a new Role in Power BI Desktop (Figure by the Author)

I created a Role in Tabular Editor, but I couldn’t rename the Role in TE, and OLS didn’t work as expected.

So, creating the Role in Power BI Desktop is the correct way.

Now, you can configure OLS for an object in Tabular Editor.

For example, when you want to restrict access to the Customer table, you will click on the table and set OLS for it:

Figure 5 — Configure OLS for the Customer table ( Figure by the Author)

Now, you must Save the change to the Model and go back to Power BI Desktop.

To see if it works, you can test it:

Figure 6 — Test OLS (Figure by the Author)

My Report, showing Customers by Geography, will Display this Message:

Figure 7 — Error with restricted access (Figure by the Author)

As you can see, both the Customer Name field and all the Measure dependent of the Customer table fail.

After setting OLS up, testing it, and publishing the Report to Power BI Service, you must assign Members to the Role, as shown in my previous article linked above.

These two features, added in the past few months, can help us add more flexibility to our Power BI solutions.

I already have two clients asking for a Solution in which I will use these new features to fulfill their requirements.

And I cannot decide which one of these two is cooler. I like both in similar ways.

Anyway, I hope that you can have fun with both of them after adding them to your toolset.

How to publish an App and create Audiences: Publish an app in Power BI — Microsoft Learn

YouTube Video on Audience by Guy in a Cube:

Object Level Security in Power BI: Object level security (OLS) — Microsoft Learn

YouTube Video on Object Level Security by SQLBI:

Hiding measures by using object-level security in Power BI — SQLBI