Object-Level Security (OLS) is a powerful feature in Power BI that allows model authors to secure specific tables or columns from report viewers. Whether you need to protect personal, financial, or other sensitive data, OLS can help ensure that only authorized viewers can see and interact with it. In this blog post, we'll explore how to effectively implement OLS and address broken visuals that can result from its use.
Like RLS, OLS is also defined within model roles. Currently, you can't create OLS definitions natively in Power BI Desktop. Third partly tools like Tabular editor.
Key points to remember regarding OLS in PowerBi-
1. OLS in PowerBi can be applied at Column/Table level but not at measure level.
2. Measures will inherit OLS restrictions applied to the columns used
in them.
3. Calculated column do not inherit OLS settings and must be secured
separately.Steps for Configuring OLS-
1. Create Roles:
Navigate to Modeling >> Manage Roles >> New Role (Similar to RLS).
When applying OLS only (without RLS), leave the role conditions blank. If using both RLS and OLS, add RLS conditions as needed.
2. Open Tabular Editor:
To work with OLS in Power BI Desktop, you'll need to use third-party tools like Tabular Editor. Install it if you haven't already.
3. Connect Tabular Editor:
Launch Tabular Editor, and it will connect with your Power BI Desktop (.pbix) file.
Select the role to which you want to apply OLS and choose the table permissions.
You'll see three options: Read, None, Default. Select "None" to hide the complete table or "Read" to restrict column-level access.
4. Configure Object-Level Security:
In Tabular Editor, navigate to Tables and select the specific column names.
Under Object-Level Security, set the security level to "None" for the role that needs restrictions.
Repeat this process for all columns that need to be restricted for a particular role.
5. Testing:
Your OLS setup is now complete. Test it to ensure that visuals using restricted columns/tables are not visible to unauthorized users.
How to fix broken visuals
There might different couple of workaround to fix lets discuss one of the best one i.e. using Field parameter in visual instead of using direct measure.
Scenario 1: Suppose you have two measures Discount and Sales. Under OLS particular group of people are not allowed to see sales. If we use OLS and put both measures individually it will break complete visual, it should show only Discount.
To overcome this scenario make a field parameter of both Discount and Sales. Use parameter in visual instead of individual measure. Discount and Sales should be measures.
Scenario 2: If you need to restrict a particular column in a visual (direct column or calculated column), using Field Parameters may not be sufficient.