Terry Hull on 03 Nov 2021 03:56:53
Object level security is great to be able to block access to sensitive data however it means visuals need to be created separately as a field block invalidates the entire visual. due to the visual not finding the field, this makes the solution impractical in the real world or greatly duplicates the work required.
An option added to the object level to return a blank , NULL or zero (not sure what technically is best) in addition to the default, read, none options for a role , would mean that shared visuals can be used, the field when restricted just shows as blank. and any formulas just use the returned value , this greatly reduces the duplicate workloads in creating separate visuals.
I get that an option for visuals to ignore fields restricted would also solve the problem , however i dont see that as an easy or short term fix but simply returning a fixed value should be straightforward in dev.
- Comments (2)
RE: Object level Security option of Return value as blank or 0
Hi, this is exactly what I'd also need. We have now a massive PBI implementation with central models with Row Level Security and as there are on top of it fields/measures that are sensitive and only a sub-set of users can see. At the moment we doing a measure curation with DAX that returns 0 if the user is not able to see it, however there is a security bridge on that approach as if a user with build access goes to PBI desktop is possible to create a completely new measure. If the new measure is based on the curated one all works good, but if the user picks up directly the table field (even if its hidden from the menu he is able to).The alternative option is implement RLS + OLS, but the OLS indeed protects the field but generate all the visuals created already or in the future breck for the users that cannot see the field. This is a huge challenge for big implementations with big user groups and does not make sense in terms of User Experience.Thanks
RE: Object level Security option of Return value as blank or 0
I think that returning blank would work just fine.