Power-Bi-Security-Rls-Best-Practices
Power-Bi-Security-Rls-Best-Practices是一款learning方向的AI技能，核心价值是Comprehensive Power BI Row-Level Security (RLS) and advanced security patterns implementation guide with dynamic security, best practices, and governance strategies，可用于解决开发者在learning领域的实际问题，帮助用户提升效率、自动化重复任务或优化工作流。
Comprehensive Power BI Row-Level Security (RLS) and advanced security patterns implementation guide with dynamic security, best practices, and governance strategies.
mkdir -p ./skills/power-bi-security-rls-best-practices && curl -sfL https://raw.githubusercontent.com/github/awesome-copilot/main/skills/power-bi-security-rls-best-practices/SKILL.md -o ./skills/power-bi-security-rls-best-practices/SKILL.mdRun in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).
Skill Content
# Power BI Security and Row-Level Security Best Practices
Overview
This document provides comprehensive instructions for implementing robust security patterns in Power BI, focusing on Row-Level Security (RLS), dynamic security, and governance best practices based on Microsoft's official guidance.
Row-Level Security Fundamentals
1. Basic RLS Implementation
// Simple user-based filtering
[EmailAddress] = USERNAME()
// Role-based filtering with improved security
IF(
USERNAME() = "Worker",
[Type] = "Internal",
IF(
USERNAME() = "Manager",
TRUE(),
FALSE() // Deny access to unexpected users
)
)2. Dynamic RLS with Custom Data
// Using CUSTOMDATA() for dynamic filtering
VAR UserRole = CUSTOMDATA()
RETURN
SWITCH(
UserRole,
"SalesPersonA", [SalesTerritory] = "West",
"SalesPersonB", [SalesTerritory] = "East",
"Manager", TRUE(),
FALSE() // Default deny
)3. Advanced Security Patterns
// Hierarchical security with territory lookups
=DimSalesTerritory[SalesTerritoryKey]=LOOKUPVALUE(
DimUserSecurity[SalesTerritoryID],
DimUserSecurity[UserName], USERNAME(),
DimUserSecurity[SalesTerritoryID], DimSalesTerritory[SalesTerritoryKey]
)
// Multiple condition security
VAR UserTerritories =
FILTER(
UserSecurity,
UserSecurity[UserName] = USERNAME()
)
VAR AllowedTerritories = SELECTCOLUMNS(UserTerritories, "Territory", UserSecurity[Territory])
RETURN
[Territory] IN AllowedTerritoriesEmbedded Analytics Security
1. Static RLS Implementation
// Static RLS with fixed roles
var rlsidentity = new EffectiveIdentity(
username: "username@contoso.com",
roles: new List<string>{ "MyRole" },
datasets: new List<string>{ datasetId.ToString()}
);2. Dynamic RLS with Custom Data
// Dynamic RLS with custom data
var rlsidentity = new EffectiveIdentity(
username: "username@contoso.com",
roles: new List<string>{ "MyRoleWithCustomData" },
customData: "SalesPersonA",
datasets: new List<string>{ datasetId.ToString()}
);3. Multi-Dataset Security
{
"accessLevel": "View",
"identities": [
{
"username": "France",
"roles": [ "CountryDynamic"],
"datasets": [ "fe0a1aeb-f6a4-4b27-a2d3-b5df3bb28bdc" ]
}
]
}Database-Level Security Integration
1. SQL Server RLS Integration
-- Creating security schema and predicate function
CREATE SCHEMA Security;
GO
CREATE FUNCTION Security.tvf_securitypredicate(@SalesRep AS nvarchar(50))
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN SELECT 1 AS tvf_securitypredicate_result
WHERE @SalesRep = USER_NAME() OR USER_NAME() = 'Manager';
GO
-- Applying security policy
CREATE SECURITY POLICY SalesFilter
ADD FILTER PREDICATE Security.tvf_securitypredicate(SalesRep)
ON sales.Orders
WITH (STATE = ON);
GO2. Fabric Warehouse Security
-- Creating schema for Security
CREATE SCHEMA Security;
GO
-- Creating a function for the SalesRep evaluation
CREATE FUNCTION Security.tvf_securitypredicate(@UserName AS varchar(50))
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN SELECT 1 AS tvf_securitypredicate_result
WHERE @UserName = USER_NAME()
OR USER_NAME() = 'BatchProcess@contoso.com';
GO
-- Using the function to create a Security Policy
CREATE SECURITY POLICY YourSecurityPolicy
ADD FILTER PREDICATE Security.tvf_securitypredicate(UserName_column)
ON sampleschema.sampletable
WITH (STATE = ON);
GOAdvanced Security Patterns
1. Paginated Reports Security
{
"format": "PDF",
"paginatedReportConfiguration":{
"identities": [
{"username": "john@contoso.com"}
]
}
}2. Power Pages Integration
{% powerbi authentication_type:"powerbiembedded" path:"https://app.powerbi.com/groups/00000000-0000-0000-0000-000000000000/reports/00000000🎯 Best For
- Security auditors
- DevSecOps teams
- Compliance officers
- UI designers
- Product designers
💡 Use Cases
- Auditing dependencies for known CVEs
- Scanning API endpoints for auth gaps
- Generating component mockups
- Creating design system tokens
📖 How to Use This Skill
- 1
Install the Skill
Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.
- 2
Load into Your AI Assistant
Open Claude or GitHub Copilot and reference the skill. Paste the SKILL.md content or use the system prompt tab.
- 3
Apply Power-Bi-Security-Rls-Best-Practices to Your Work
Provide context for your task — paste source material, describe your audience, or share existing work to guide the AI.
- 4
Review and Refine
Edit the AI output for accuracy, tone, and completeness. Add human insight where the AI lacks context.
❓ Frequently Asked Questions
Can this replace a dedicated SAST tool?
AI-based security review is complementary to SAST tools. Use it as a first-pass filter, not a replacement.
Does this work with Figma?
Some design skills integrate with Figma plugins. Check the Works With section for supported tools.
How do I install Power-Bi-Security-Rls-Best-Practices?
Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/power-bi-security-rls-best-practices/SKILL.md, ready to use.
Can I customize this skill for my team?
Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.
⚠️ Common Mistakes to Avoid
Only scanning surface-level issues
Deep security review requires understanding your app architecture, not just regex patterns.
Skipping usability testing
AI-generated designs should be validated with real users before development.
Not reading the full skill
Skills contain important context and edge cases beyond the quick start.