You’ve heard about the Oblect-level security feature in Power BI, but you’ve also heard that you CAN’T configure it directly from the Power BI Desktop? And, that you must use an external tool, such as Tabular Editor, to configure and manage OLS.
Well, this is not the case anymore! With the new TMDL view in Power BI Desktop, you can define Object-level security directly in the Power BI Desktop.
If you are wondering what Object-level security is, I suggest you start by reading this article. If you are not sure what the TMDL view is, I’d encourage you to check this blog post from Rui Romano.
If you’ve worked with Power BI before the TMDL view was introduced, and had requirements to set up OLS, then you already know that it had to be implemented via Tabular Editor (or a similar external tool that can write to a semantic model via XMLA endpoint).
Step-by-step tutorial
The initial steps are unchanged when you use the TMDL view for implementing OLS. You first need to create a role. I’ll call this one No Order Quantity:
There are no rules enforced for this role (this would have been necessary for the Row-level security) – it’s just an empty security role.
Let’s now open the TMDL view and drag the role definition to the view canvas:
This is an empty role definition in TMDL. We now need to extend it with our Object-level security definition. I’ll provide the table name (FactInternetSales) and the column name (OrderQuantity) and set the permission to none.
Once I hit Apply at the top, the role definition will be updated in the model. Let’s go back and test the report view when someone who belongs to the “No Order Quantity” role opens the report page.
Works perfectly! Thanks to the TMDL view, we can now implement OLS directly from the Power BI Desktop.
P.S. You can grab the pseudocode snippet at https://fabsnippets.replit.app/ (thanks to Matt Meyer from Microsoft for bringing this website to my attention). There are already many super useful, ready-made TMDL snippets you can use for free.
Thanks for reading!
Last Updated on March 5, 2025 by Nikola
Terry Hull
Great news!, for a cleaner result if you use the parameter fields function to include the fields for your visual, the visual doesn’t break when the role is applied. This means you can have a dynamic view of the one visual based on what role the user has.
Ulrik Harnisch
Didn’t know that. This is awesome! When You toggle it once, the visual never breaks. Really awesome, kept looking for this solution. Thanks a lot!
Nikola
You are very welcome!
Hussein Satour
Great! Thank yo very much