Object level security (OLS)

Object-level security (OLS) enables model authors to secure specific tables or columns from report viewers. For example, a column that includes personal data can be restricted so that only certain viewers can see and interact with it. In addition, you can also restrict object names and metadata. This added layer of security prevents users without the appropriate access levels from discovering business critical or sensitive personal information like employee or financial records. For viewers that don’t have the required permission, it's as if the secured tables or columns don't exist.

Create a report that uses OLS

Like RLS, OLS is also defined within model roles. Currently, you can't create OLS definitions natively in Power BI Desktop.

To create roles on Power BI Desktop semantic models, use external tools such as Tabular Editor.

Configure object level security using tabular editor

1. In Power BI Desktop, create the model that will define your OLS rules.

2. On the External Tools ribbon, select Tabular Editor. If you don’t see the Tabular Editor button, install the program. When open, Tabular Editor will automatically connect to your model.

3. In the Model view, select the drop-down menu under Roles. The roles you created in step one will appear.

4. Select the role you want to enable an OLS definition for, and expand the Table Permissions.

5. Set the permissions for the table or column to None or Read.

   None: OLS is enforced and the table or column will be hidden from that role
   Read: The table or column will be visible to that role

   To secure the whole table

   Set categories under Table permissions to None.

   To secure a specific column

   Select the category and set the Object Level Security to None.

---

6. After you define object-level security for the roles, save your changes.

7. In Power BI Desktop, publish your semantic model to the Power BI Service.

8. In the Power BI Service, navigate to the Security page by selecting the more options menu on the semantic model, and assign members or groups to their appropriate roles.

The OLS rules are now defined. Users without the required permission will receive a message that the field can't be found for all report visuals using that field.

Considerations and limitations

• OLS only applies to Viewers in a workspace. Workspace members assigned Admin, Member, or Contributor have edit permission for the semantic model and, therefore, OLS doesn’t apply to them. Read more about roles in workspaces.

• Semantic models with OLS configured for one or more table or column objects aren't supported with these Power BI features:

  • Q&A visualizations
  • Quick insights visualizations
  • Smart narrative visualizations
  • Excel Data Types gallery

• See other OLS restrictions

Related content

• Object-level security in Azure Analysis Services
• Power BI implementation planning: Report consumer security planning
• Questions? Try asking the Power BI Community
• Suggestions? Contribute ideas to improve Power BI