Row Level Security – Part 9 | Migrating AAS to PPU
In this blog post I am going to cover how to implement Row Level Security (RSL) when using AAS and how this can be done on PPU.
In my example below I am going to show creating to simple RLS roles which will limit data for the users who belong to 2 roles.
Role 1 – USA
- This role is limited where the SalesTerritoryCountry = “United States”
Role 2 – Europe
- This role is limited where the SalesTerritoryCountry = “Europe”
- The table which contains this is shown below
One final point to make is that it is also possible to configure Dynamic RLS, which is beyond the scope of this blog post where I am comparing how to configure RLS between AAS and PPU
Here are the previous 8 blog posts that I have completed in the series.
AAS – Roles
Below is how I would create and configure roles in AAS using Visual Studio.
I right click on Roles, click on New and I configured the USA Role as shown below.
Next, I clicked on new again and gave the role a name of Europe and configured it as shown below.
With both roles below I would add in the AAD Security Groups (Best practice) or individual users if required.
I would then deploy these roles to my AAS server using BISM Normalizer which I explained in my previous blog post: Deployments – Part 8 Migrating from AAS to PPU – Reporting/Analytics Made easy with FourMoo and Power BI
PPU – Roles
Now to create the same roles for PPU, I will be doing this in Power BI Desktop
NOTE: Currently it is not possible to create and or update roles using Tabular Editor (As at Aug 2021)
In Power BI Desktop I click on Mange Roles
I then create the USA Role as shown below.
Next, I created my role for Europe
One key difference when using PPU is I must now deploy my changes to the Power BI Service.
This is because when authoring in Power BI Desktop it does not have or know the AAD groups or users. This needs to be configured in the next steps below.
I deployed the changes using ALM Toolkit, which I explained in my previous blog post: Deployments – Part 8 Migrating from AAS to PPU – Reporting/Analytics Made easy with FourMoo and Power BI
This is what it looks like in ALM Toolkit
I then deployed the changes.
The final step was to go into my data set settings, then Security
I then added in the required AAD Security Groups or users to the required Role. Here is an example below for the USA Role.
I then clicked Save and the user will now have access in the role defined.
Once again it does appear to me that when moving from AAS to PPU with regards to RLS it is relatively easy to achieve the same outcomes.
Whilst it is a little different, it is still easy to get done. Not only that but there is also a lot of documentation, blogs, and videos on how to setup and configure different RLS requirements. Which makes it quicker and easier to get RLS working and if you get stuck there are resources and people to assist you.
Thanks for reading and if there are any comments or suggestions, please leave them in the section below.