Create Role-Based Dashboards in Power Platform

Role-Based Dashboards That Don’t Break: AAD + Power BI RLS + Power Apps, Done Right

TL;DR

• Map roles before models. Define personas → AAD groups → dataset roles → page/report visibility.

• Enforce in the dataset, not the workspace. RLS/OLS lives in the semantic model; workspace perms ≠ data security.

• Personalize via context. Power Apps reads user/org data (Graph), passes filters to embedded Power BI, aligned with RLS.

• Automate membership. Dynamic AAD groups + lifecycle policies stop privilege creep and “Everyone” accidents.

---

The Role Mapping Framework (the part everyone skips)

1. Personas: Executive, Regional Lead, Manager, Analyst, Auditor.

2. Data scope: Company / Region / Team / Self / Read-only compliance.

3. AAD groups: One per persona×scope (prefer dynamic rules: department, region, jobTitle).

4. Dataset roles: Exec_All, Region_Lead, Mgr_Team, Analyst_Region, Auditor_Read.

5. RLS filters: Drive from lookup tables (Users, Teams, Regions) linked to fact tables.

6. Distribution: Power BI App with audience views (Exec | Ops | Audit) mapped to the same model.

---

AAD ↔ Power BI: Security That Actually Works

• Create dynamic security groups (attribute-based) for each persona.

• In Power BI dataset, create matching roles and assign AAD groups (not individuals).

• Implement User table with UserPrincipalName, Department, Region, ManagerObjectId.

• RLS pattern:

  • Exec: TRUE() (with export limited by policy)

  • Region lead: 'Facts'[Region] IN VALUES('UserRegions'[Region])

  • Manager: 'Facts'[ManagerId] = LOOKUPVALUE('Users'[ObjectId], 'Users'[UPN], USERPRINCIPALNAME())

  • Analyst: Scope by region/product family via bridge.

• Test RLS with “View as” for real personas before go-live.

---

Power Apps → Power BI: Context-Driven Personalization

• Power Apps captures user context (Graph): department, groups, manager, region.

• Pass context to embedded Power BI via filters/slicers on load (e.g., region, teamId).

• Golden rule: App-level filters must align with dataset RLS (defense-in-depth). App UI ≠ security boundary.

• Use conditional visibility in Power Apps to show/hide report pages, actions, and cards per persona.

---

Implementation Blueprint (Step-by-Step)

1. Data model: Build shared semantic model; add Users, Teams, Regions lookups; relate to facts.

2. RLS: Author roles; encode DAX filters via lookup tables (no hard-coded emails).

3. AAD: Create dynamic groups; backfill attributes (HRIS → Entra ID provisioning).

4. App audiences: Publish as Power BI App with separate audiences; one model, many views.

5. Power Apps shell (optional): Read Graph → set variables → prefilter PBI; add actions (approve, assign, comment).

6. Governance: Sensitivity labels, DLP, export restrictions; monitor activity logs.

7. Runbooks: Onboarding/offboarding, quarterly access recertification, RLS unit tests.

---

RLS Patterns You’ll Reuse

• Manager-of tree: Leverage a flattened org table (manager hierarchy) for “my team” views.

• Multi-region analysts: Bridge table UserRegions many-to-many to regions for additive scope.

• Cell-level privacy: Combine RLS with Object-Level Security (OLS) to hide sensitive columns (e.g., salary).

• Hybrid visibility: Audience-specific navigation (Exec gets KPI page; Analyst gets drill pages) over the same model.

---

Automation at Scale (no ticket queues)

• Dynamic groups: Rules like (department -eq "Sales") -and (country -in ["DE","FR"]).

• Lifecycle: Auto-expire privileged access; remove dormant users; JIT elevation for temporary roles.

• Provisioning: HRIS → Entra ID attributes → dynamic groups → immediate RLS effect (no manual updates).

• Health checks: Scheduled script to diff workspace perms vs dataset role assignments; alert on drift.

---

Performance & UX

• Keep the model central; ship audience-specific apps/pages, not duplicated reports.

• Limit visuals per page (≤ 8), use aggregations/Hybrid tables for large facts.

• Cache critical tiles; prefer parameterized measures over proliferating pages.

• Mobile: publish a lite view (cards, KPIs, slicers) for managers on the go.

---

Pitfalls → Fixes

• Workspace access only (no RLS): Users see too much. → Move security into dataset roles; restrict Export.

• Stale groups: Manual updates lag org changes. → Switch to dynamic AAD groups + HR sync.

• App filters ≠ RLS: Users bypass UI filters. → Mirror logic in RLS; test “View as”.

• Persona sprawl: Many copies of reports. → One model; audiences + navigation; parameterized bookmarks.

• Privilege creep: Old projects linger. → Quarterly recertification; auto-revoke after role changes.

---

KPIs for “It’s Working”

• Access incidents per month ↓

• Time-to-onboard/offboard (role effective) ↓

• Duplicate reports per subject area ↓

• Executive/Manager adoption (weekly active viewers) ↑

• Data export attempts blocked (justified) — tracked & reviewed

---

Quick-Start Checklist (copy/paste)

• Inventory personas, scopes, and sensitive fields.

• Create dynamic AAD groups; backfill user attributes.

• Build Users/Teams/Regions tables; wire DAX RLS.

• Publish one shared model; create App audiences.

• Align Power Apps context filters with RLS; test.

• Enable labels/DLP; restrict export/Share as needed.

• Schedule monthly RLS “View as” tests + access diffs.