---
description: Step-by-step guidance through DataCentral
---

# Tutorials

Below are tutorials designed to simplify understanding of DataCentral, guiding you through the process of getting started with DataCentral and sharing information with diverse audiences.

Under each tutorial, you will find an overview of its content and the prerequisites necessary for completing it.

List of tutorials:

* [Fundamentals with your Azure AD](#fundamentals-with-your-azure-a-d)
* [Sharing with External Azure AD users](#sharing-with-external-azure-a-d-users)
* [Configuring and using Power BI Service Principal](#configuring-and-using-power-bi-service-principal)
* [Row-Level Security with Power BI Service Principal](#row-level-security-with-power-bi-service-principal)

## Fundamentals with your Azure AD

Use Azure AD authentication to explore the basics of DataCentral. A free tenant is provided for testing, requiring no configurations or installations. The tenant will use the common endpoint for Power BI, with only internal AD sharing available. If you want to try external Azure AD sharing, see this [tutorial](#sharing-with-external-azure-a-d-users).

Content of tutorial:

* [x] Azure AD authentication
* [x] Embedding report or app from your workspace
* [x] Adding internal Azure AD users to Tenant
* [x] Sharing report or app with internal Azure AD users

### Pre-requirements

* Azure AD user account
* Power BI Pro license
* Admin member on Workspace in Power BI

### Tutorial Step-by-Step

#### Authenticate to DataCentral

An email confirmation link from signing up to Free-Tutorial, will redirect you to your assigned DataCentral Tenant. The next step is to authenticate using your Azure AD credentials.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FvxrB7IYV1NPRnruqHyfD%2Fimage.png?alt=media&#x26;token=67580219-1a05-4f58-bf61-10f13809db23" alt=""><figcaption><p>Authenticate with Azure AD</p></figcaption></figure>

#### Home Page

Upon logging in, you will see the home page with the navigation bar on the left. The home page will display the report of your choice, pinned for your users in the Tenant.

Navigation bar:

* Home:
  * A pinned report of your choice for users in current Tenant.
  * Users will have the option to pin their favorite report to the home page.
* Administration:
  1. Users: Add new user to your Tenant
  2. Power BI Items: Add a report or app from your Power BI environment
  3. Languages: Changing the default language of your Tenant

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FqqSVfkhVJ9U8KJoCBwbU%2Fimage.png?alt=media&#x26;token=127b03cd-b99b-442b-abdf-cc0e8111f39d" alt=""><figcaption><p>Home page</p></figcaption></figure>

#### Adding Power BI report or app to your Tenant

Under '_Administration -> Power BI Items'_ or by clicking on '_Go to reports'_ you can manage which Power BI Items are added to your Tenant. Within '_Power BI Items'_ menu you can click on '_Manage Workspaces'_ in the top right corner.

To see more about Workspace Management click [here](item-management).

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F3nmeAxDWIZ5jo6Kk7ClA%2Fimage.png?alt=media&#x26;token=7b50f634-fb4c-4bbd-8d2d-d31bc95efdfc" alt=""><figcaption><p>Power BI Items menu</p></figcaption></figure>

The menu will display all the workspaces where you are an admin in Power BI Service. Choose a workspace from which you want to embed a report into your Tenant, and click '_Save'._

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FNKyehzraL0Ih1fXtmkd7%2Fimage.png?alt=media&#x26;token=311b1a0e-815b-42d5-9b72-de04c6435b9f" alt=""><figcaption><p>Workspaces available</p></figcaption></figure>

Now, you can click '_+ Add new item_' and perform three operations:

1. Link Report: Embed report of your choice from workspace to Tenant
2. Link App: Embed app of your choice from workspace to Tenant
3. Upload Report: Upload .pbix file to your workspace from your Tenant

In this tutorial, we will '_Link report'_ Choose the workspace from which you want to embed the report and locate the report.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F7SiCKgSldD2Q7efkpmzq%2Fimage.png?alt=media&#x26;token=f105eb58-eec5-43b8-8f08-fe82085dd7a0" alt=""><figcaption><p>Operations to workspace</p></figcaption></figure>

You can now enter additional information about the report. Once you have provided all the necessary details, click '_Save'._

{% hint style="info" %}
**Important:** Before clicking '_Save_', ensure that the report has the '_User'_ role. Users in your Tenant with the '_User'_ role will then be able to see the report.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FUYVGw3zW0siKpkhMKuZh%2Fimage.png?alt=media&#x26;token=793e2d0f-e1df-4f16-aefb-4ea6ea9fccf9" alt=""><figcaption><p>Report additional information</p></figcaption></figure>

The report from your workspace has now been embedded into your tenant. Repeat this process if you want to add more reports or apps.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FRvyEJhBZePtislfuNL0y%2Fimage.png?alt=media&#x26;token=79ad0422-82e4-459e-a8de-25a4333587c8" alt=""><figcaption><p>Embedded report</p></figcaption></figure>

#### Share report or app with internal Azure AD in Tenant

Easily share report or app that you have added to your Tenant with internal Azure AD colleagues. Depending on the roles you assign to your users, they can access different reports available within the Tenant.

Pre-requirements for internal AAD.

* Azure AD account
* Power BI Pro license (if workspace is not on a dedicated capacity)
* Azure AD is at least '_Viewer'_ member on Workspace(s) that report / app is embedded from

Go to '_Administration -> Users'_ to manage users added to your tenant. Begin by clicking on '_+ Create new user_' in the top right corner.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FfEPNkpbFWyC3SCCpS0mk%2Fimage.png?alt=media&#x26;token=dcd7e3fe-839d-4ef5-8199-025c04b478b3" alt=""><figcaption><p>User Management</p></figcaption></figure>

Enter the email address of the Azure AD user you intend to add, then navigate to '_Roles'._

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FBFJrxPEDEQ6vXTy3Kybp%2Fimage.png?alt=media&#x26;token=a8dc020f-2a7a-4286-ae2e-20511df58a5d" alt=""><figcaption><p>Adding a Azure AD</p></figcaption></figure>

Keep in mind that the roles you assign to your users determine which items they can access within the Tenant. In this case, assign the "User" role to the Azure AD user. Then click '_Save'_.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fi4BBlC83HJLtrGdnDxNF%2Fimage.png?alt=media&#x26;token=b0048e94-bd29-4b79-adf9-06fa34a28fd0" alt=""><figcaption><p>Role assignment</p></figcaption></figure>

An internal Azure AD authenticates to the Tenant and can view only the item(s) assigned the 'User' role.

{% hint style="info" %}
**Important**: The internal Azure AD user will only be able to embed a report or app if they have at least '_Viewer'_ permissions within the workspace in Power BI from which the items are embedded or if they are part of a security group with equivalent permissions.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fn4uDEjtAw0waV3b5Grli%2Fimage.png?alt=media&#x26;token=f2c2c610-8002-4c00-8636-edd313674c77" alt=""><figcaption><p>Report embedded for Azure AD</p></figcaption></figure>



***

## Sharing with External Azure AD users

Configure your Tenant with your organizational Azure Tenant ID. This will enable your users to authenticate against your Power BI environment and access reports in workspaces with the appropriate permissions.

Content of tutorial:

* [x] Configure your DataCentral Tenant
* [x] Embedding report or app from your workspace
* [x] Adding external Azure AD user to Tenant
* [x] Sharing report or app with external Azure AD user

### Pre-requirements

* DataCentral Pro
* Azure Tenant ID
* Azure AD user account
* Admin member on Workspace in Power BI
* Power BI Pro license

### Tutorial Step-by-Step

#### Authenticate to DataCentral

Go to your DataCentral Tenant and authenticate using your Azure AD credentials.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FIQUCuCPYjmARs9sQPE1t%2Fimage.png?alt=media&#x26;token=cf6f72b3-226e-4c4c-b254-d3f42c854e3e" alt=""><figcaption><p>Authenticate with Azure AD</p></figcaption></figure>

#### Configure your DataCentral Tenant to your organizational Azure Tenant ID

Under '_Administration -> Settings'_, navigate to '_Azure Configurations'_ where you can add your Azure Tenant ID, enabling users to authenticate to your Power BI environment. Click '_Save'_.

Optionally, you can set '_Internal Domains'_ to distinguish internal AD from external AD within your tenant. You will need to manually add the external Azure AD as a guest in your Azure Portal so they are able to authenticate to your Azure Tenant ID. If you want to automate this process, implement the Graph Service Principal. Click [here](../deployments/graph-service-principal) to learn more.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FnkaDsixQPWqHC63y5NQ1%2Fimage.png?alt=media&#x26;token=7a03d0d2-f161-4c94-9ddb-48466ab9519a" alt=""><figcaption><p>Azure Configurations</p></figcaption></figure>

#### Share report with external Azure AD in Tenant

With the Azure Tenant ID configured, you can add and share reports or apps within your Tenant with external Azure AD. Depending on the roles assigned to your users, they can access different subsets of reports available within the Tenant.

Pre-requirements for external Azure AD.

* Azure AD account
* Power BI Pro license (if workspace is not on a dedicated capacity)
* Azure AD is at least '_Viewer_' member on Workspace that report or app is embedded from

Go to '_Administration -> Users_' to manage the users in your Tenant. Start by clicking on '_+ Create new user'_ in the top right corner.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F0XwGt0hGwTbI4zokqzia%2Fimage.png?alt=media&#x26;token=1d6832b5-80c1-447a-81bc-cae5f9567215" alt=""><figcaption><p>Adding a new user to Tenant</p></figcaption></figure>

Enter the email address of the external Azure AD user you intend to add, then navigate to '_Roles'._

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FYrjrBjocPr17MSeGxOnS%2Fimage.png?alt=media&#x26;token=a47b1f40-3336-4963-b492-b4e9c6fefc75" alt=""><figcaption><p>Azure AD user</p></figcaption></figure>

Keep in mind that the roles you assign to your users determine which items they can access within the Tenant. In this case, assign the '_User'_ role to the Azure AD user. Then click '_Save'_.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FkNxumKIpAcJLSUV7MLKu%2Fimage.png?alt=media&#x26;token=c3db3102-e1a2-4771-9a81-dad4db3f02d5" alt=""><figcaption><p>Role on Azure AD user</p></figcaption></figure>

Now, you will see that the external Azure AD user has been added to the tenant. They will be able to authenticate to the Tenant and access the report or app.

{% hint style="info" %}
**Important:** You will need to manually add the external Azure AD as a guest in your Azure Portal so they are able to authenticate to your Azure Tenant ID if a [Graph Service Principal ](../deployments/graph-service-principal)has not been configured.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FekkdTPmKclF35uwNvRrF%2Fimage.png?alt=media&#x26;token=a963af09-5d09-4717-8224-1109e91bfbcc" alt=""><figcaption><p>Users of Tenant</p></figcaption></figure>

The first time the external Azure AD user authenticates to your Tenant, they will be prompted with this window and will need to accept. This is the minimum privilege Microsoft Authenticator needs to verify the identity of the user signing in.

{% hint style="info" %}
If an external Azure AD user is a global administrator in their organization, they will be able to '_Consent on behalf of your organization_.' Consequently, users from their organization will have this consent pre-accepted and will not receive the prompt.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FJ2C1714qCRnLqQYC3da7%2Fimage.png?alt=media&#x26;token=38ac3fa2-97dc-48d9-bcfd-54dad41c02e2" alt=""><figcaption><p>First time authentication prompt (normal user)</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FFETfluHkdH4bezdMfcKo%2Fimage.png?alt=media&#x26;token=79a5046a-e57d-4a9f-a4ef-2bdeca95e585" alt=""><figcaption><p>First time authentication prompt (global administrator)</p></figcaption></figure>

Here, the external Azure AD user has authenticated to the Tenant and can see the respective reports or apps assigned to their Role.

{% hint style="info" %}
**Important**: The external Azure AD user will only be able to embed a report or app if they have at least "Viewer" permissions within the workspace in Power BI from which the items are embedded or if they are part of a security group with equivalent permissions.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FlcdoeaSsuVfQT0grYMdH%2Fimage.png?alt=media&#x26;token=b93d4177-bd32-466e-b7ce-5fcc0bf9a9e1" alt=""><figcaption><p>Report embedded for external Azure AD</p></figcaption></figure>



***

## Configuring and using Power BI Service Principal

This will allow your Azure AD users to embed reports without needing Power BI Pro license, and it will unlock new user types, such as User Pass and Mobile ID, that can embed through your Service Principal. Additionally, certain [features](features) are now available within your Tenant.&#x20;

Content of tutorial:

* [x] Configure your Power BI Service Principal
* [x] Embedding report or app through the Service Principal
* [x] Workspace on Dedicated Capacity
* [x] Features with Service Principal

### Pre-requirements

* DataCentral Pro
* Azure Tenant ID
* Azure AD user account
* Workspace on a Dedicated Capacity

### Tutorial Step-by-Step

#### Create your Power BI Service Principal in Azure

Click [here](../deployments/power-bi-service-principal) to go through the step-by-step guide to create your own Power BI Service Principal.

After creating your Power BI Service Principal, collect these values from the Azure Portal to complete this step-by-step tutorial.

* Directory (tenant) ID
* Application (client) ID
* Client Secret

#### Authenticate to DataCentral

Go to your DataCentral Tenant and authenticate using your Azure AD credentials.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fb6vHYsTtqnqOwHlizifa%2Fimage.png?alt=media&#x26;token=02b20443-f742-4a3e-ad1d-31a3515c3174" alt=""><figcaption></figcaption></figure>

#### Configure your Power BI Service Principal to your Tenant

Under '_Administration -> Settings'_, navigate to '_Azure Configurations'_ where you can add your Power BI Service Principal.

Optionally, you can select the '_Only use Service Principal to manage items and workspaces in tenant'_ checkbox to restrict embedding in your Power BI environment to only the Service Principal(s). In this case, your and other admin Azure AD accounts will not be able to embed reports or apps.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FexLQAwTqditXdX9xG77b%2Fimage.png?alt=media&#x26;token=090d5351-f9cf-4069-9f7c-eee2699f7115" alt=""><figcaption></figcaption></figure>

The ability and benefits of using [multiple service principal](../features#multiple-power-bi-service-principals) can be highly valuable. You would then also complete the setup for Power BI Service Principals 2 and 3, and enable them.

#### Add a report or app through Power BI Service Principal

Now you are able to share reports or apps, and enable certain features on reports with the Power BI Service Principal. To see the full list of features that can be used click [here](features).

Go to '_Administration -> Power BI Items_' where you manage which Power BI Items are added to your Tenant. Within '_Power BI Items_' menu you can click on '_Manage Workspaces'_ in the top right corner.

If you checked the box '_Only use Service Principal to manage items and workspaces in tenant'_ in Azure Configurations then you will only see workspaces your Service Principal has access to. If the box is unchecked the normal workspace management will occur through your Azure AD user.

{% hint style="info" %}
**Important:** Your Service Principal must have, at a minimum, 'member' permissions in the workspace to which report or app exists.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FHaSgLYpEZnqYhgP96VyC%2Fimage.png?alt=media&#x26;token=e0aaa240-fe37-4fed-bfc1-67143ea847de" alt=""><figcaption></figcaption></figure>

Choose a report that you want to share with users who don't have a Power BI Pro license. Then click '_Save'_.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F8YGMKOW4bZSDLEZTFHjP%2Fimage.png?alt=media&#x26;token=5c5871c4-c809-4f8e-8e44-6652f55a9e46" alt=""><figcaption></figcaption></figure>

#### Share report with Azure AD without Pro License or User Pass / Mobile ID

Go to '_Administration -> Users'_ to manage the users in your tenant. Start by clicking on '_+ Create new user'_ in the top right corner.

Add three user types and make sure that they have correct role to see the report within Tenant:

* Azure AD
* User Pass
* Mobile ID

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fr226s3iHm4rvRuagSEG6%2Fimage.png?alt=media&#x26;token=51b47774-5f3b-48ba-b0cb-cfbbdf446bc0" alt=""><figcaption><p>Azure AD user</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FpHcTkycZBfYXO9xAkKYR%2Fimage.png?alt=media&#x26;token=156ebf12-4b60-4fa4-9dbf-e6ee4cd45511" alt=""><figcaption><p>User Pass</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FGAKf7EhaW5lHbKjDTmvo%2Fimage.png?alt=media&#x26;token=723c51bd-7557-4300-9381-25f5ece16843" alt=""><figcaption><p>Mobile ID</p></figcaption></figure>

After creating all three user types, allow them to authenticate to your DataCentral tenant and observe how they can view reports within their role scopes.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fq0WJPjeoCsIcQs9DqOit%2Fimage.png?alt=media&#x26;token=92d4ad83-b284-4ccd-8923-90d9d738c093" alt=""><figcaption><p>Users within Tenant</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F8DlqNKoLzkt0fC8VGvtV%2Fimage.png?alt=media&#x26;token=8fd52e46-29a0-4b65-a6dc-cd9efdaad17d" alt=""><figcaption><p>external Azure AD embedding through Service Principal</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FthKU7DpnmsK2Y9wqly7a%2Fimage.png?alt=media&#x26;token=08194a47-a1d9-49f1-82e1-6d34aae7d498" alt=""><figcaption><p>User Pass embedding hthrough Service Principal</p></figcaption></figure>

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FcHGDNnAfjCn7MhCUo61N%2Fimage.png?alt=media&#x26;token=7bd06eea-1033-43f3-8078-118b1fc6654b" alt=""><figcaption><p>Mobile ID embedding through Service Principal</p></figcaption></figure>

***

## Row-Level Security with Power BI Service Principal

Enforcing row-level security (RLS) in your data models can simplify data management by allowing one model to serve multiple purposes, eliminating the need for duplicating models and adding unnecessary complexity. Here are two methods for implementing row-level security using your [Power BI Service Principal](../deployments/power-bi-service-principal) for your users.

1. [**Row-Level Security with Role Codes:**](#row-level-security-with-role-codes) Creating specific Role Codes, which are passed along with the Power BI Service Principal to the RLS Dataset.
2. [**Dynamic Row-Level Security with UserPrincipalName function:**](#dynamic-row-level-security-with-userprincipalname-function) Creating a role in Power BI Desktop using the UserPrincipalName() function that plays a crucial role in dynamic row-level security.

Content of tutorial:

* [x] Ensure efficient and secure sharing through Row-Level Security
* [x] Using 'Role Codes' with Power BI Service Principal
* [x] Using 'DynamicRLS' and UserPrincipalName() function.

### Pre-requirements

* DataCentral Pro
* Azure Tenant ID
* Azure AD user account
* Power BI Service Principal
* Workspace on a Dedicated Capacity

***

### Row-Level Security with Role Codes

#### Create data model and manage roles within Power BI Desktop

In Power BI Desktop, go to Manage Roles and create specific roles that filter particular table based on the selected role. In this example, five roles have been created: AdminRLS, APAC, EMEA, LATAM, and NA. These roles filter the data model to specific country groupings (AdminRLS has access to all country groupings).

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FCqsRpZSROu56Q2gUkaG0%2Fimage.png?alt=media&#x26;token=1c24adba-5237-4980-b50e-78853891f6ce" alt=""><figcaption><p>Power BI Desktop 'Modeling -> Manage Roles'</p></figcaption></figure>

After publishing the report to a workspace of your choice, your RLS dataset should include these defined roles.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fd9LVdX4sLfouix5zMvsa%2Fimage.png?alt=media&#x26;token=f45faa3e-2666-48a1-af6c-a3d4bac22568" alt=""><figcaption><p>RLS Dataset Security</p></figcaption></figure>

#### Add the Row-Level Security report to Tenant

In your DataCentral Tenant go to '_Administration -> Power BI Items_' and add the Row-Level Security Report to your Tenant.

{% hint style="info" %}
**Important:** Your Service Principal must have, at a minimum, 'member' permissions in the workspace to which report exists.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FRzNAftjgsSu2P0rIq0Kc%2Fimage.png?alt=media&#x26;token=0f4b2b7e-f45c-4b03-b3b9-2093f8c20c63" alt=""><figcaption><p>RLS Report in Tenant</p></figcaption></figure>

#### Add or create users and attach 'Role Codes'

Go to '_Administration -> Users'_ and add or edit the current user who will be using your Power BI Service Principal to embed the report. This can be an Azure AD account, a User Pass, or a Mobile ID.

It is important to have already created the roles under '_Administration -> Roles'_. Click [here ](../user-and-role-management#creating-roles)to read more about Role Management.

The same process for using '_Role Codes_' applies to all user types. In this example, Mobile ID is used.

The user should have specific roles assigned to them, which the Power BI Service Principal will use to ensure the security with the dataset and visibility of the report.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FM8q3CSCnMliMvZ0IghJv%2Fimage.png?alt=media&#x26;token=e56d22d9-300d-4286-8b62-a906e1d8851c" alt=""><figcaption><p>Role Codes for user</p></figcaption></figure>

#### User authenticates to Tenant and embeds row-level security report

The chosen user authenticates to your DataCentral tenant, embeds the report, and only receives the data they are authorized to access. In this case, the data is limited to APAC and EMEA.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FjLnWPHLZXeBII9lt21Or%2Fimage.png?alt=media&#x26;token=11fc63a7-1021-4164-9141-83a6c3b91af6" alt=""><figcaption><p>Role Codes within RLS Report</p></figcaption></figure>

If we edit the user's roles and assign them the AdminRLS role, they will be able to see all country groupings as configured within the data model for that role.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FzDKpSRBeuZhHw3Ugu4kA%2Fimage.png?alt=media&#x26;token=12bf2cea-5d9b-4852-a746-e4a5baa4bcbc" alt=""><figcaption><p>Role Codes for user</p></figcaption></figure>

The user can now refresh their browser, and they will receive all the data because they are in the '_AdminRLS_' Role.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2F6zkvZPIQJ92OU3LD0S5Q%2Fimage.png?alt=media&#x26;token=06523052-c3b0-41a3-9331-efb9fd582077" alt=""><figcaption><p>Role Codes within RLS Report</p></figcaption></figure>

If you have for example +10 Role Codes and don't want to create all those roles in Power BI Desktop you would benefit using [Smart RLS](../features#smart-rls).

***

### Dynamic Row-Level Security with UserPrincipalName function

#### Create data model and manage roles within Power BI Desktop

In Power BI Desktop, navigate to '_Manage Roles_' and create a specific role that filters particular tables based on the user embedding the report. In this example, a dynamic role is created, and logic around the UserPrincipalName() function is used to filter the data.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FoYbwmjNfKlRrqKEljo6d%2Fimage.png?alt=media&#x26;token=fd4e0384-30fe-43f0-ab50-19d920bbc273" alt=""><figcaption><p>Dynamic RLS role with DAX to filter data</p></figcaption></figure>

After publishing the report to a workspace of your choice, your RLS dataset should include the defined role.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FaKAZ4iBeECt9GPOUlFSO%2Fimage.png?alt=media&#x26;token=e6c8b54e-df3e-47ca-904f-57259bf95dd5" alt=""><figcaption><p>RLS Dataset Security</p></figcaption></figure>

#### Add the Row-Level Security report to Tenant

In your DataCentral Tenant go to '_Administration -> Power BI Items'_ and add the RLS Report to your Tenant.

{% hint style="info" %}
**Important:** Your Service Principal must have, at a minimum, '_member_' permissions in the workspace to which report exists.
{% endhint %}

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fy1WQk8GEgSH7ZopCsROf%2Fimage.png?alt=media&#x26;token=08a98536-1b0e-4f45-9a6a-c094758aaa06" alt=""><figcaption><p>RLS Report in Tenant</p></figcaption></figure>

#### Add or create users and attach the dynamic role

Go to '_Administration -> Users_' and add or edit the current user who will be using your Power BI Service Principal to embed the report. This can be an Azure AD account, a User Pass, or a Mobile ID.

It is important to have already created the role that you defined in the Dataset under '_Administration -> Roles'._ Click [here ](../user-and-role-management#creating-roles)to read more about Role Management.

The same process for using '_Dynamic RLS_' applies to all user types. In this example, Mobile ID is used.

The user should have the role assigned to them, which the Power BI Service Principal will use to ensure the security with the dataset and visibility of the report.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FZOkVMSrXWc4OlA337vtJ%2Fimage.png?alt=media&#x26;token=a8b86337-1951-4a15-9e5e-50b24c580829" alt=""><figcaption><p>Role Codes for user</p></figcaption></figure>

#### User authenticates to Tenant and embeds row-level security report

The selected user authenticates to your DataCentral tenant, embeds the report, and only receives the data they are authorized to access based on the DAX definition within the DynamicRLS role.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2FT1V48b5Z3gaGwnwvhpxQ%2Fimage.png?alt=media&#x26;token=6f887cd5-0550-4980-a209-4ec24082d4ed" alt=""><figcaption><p>Report using Dynamic RLS</p></figcaption></figure>

If another Mobile ID user is given access to this report, they will receive a different set of data based on the DynamicRLS, which is determined by their UserPrincipalName() and DAX logic.

<figure><img src="https://1952150759-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfEoiVXBZDmtsCCNsaMab%2Fuploads%2Fnvih3vGB148Z2TfuQfqp%2Fimage.png?alt=media&#x26;token=91780430-b47c-47a3-9041-a22c31251450" alt=""><figcaption><p>Report using Dynamic RLS</p></figcaption></figure>

