01
Row-level security
Each person's rows are filtered by who signs in. Funds, properties, and entities they are not cleared for never reach their screen.
- DAX roles
- dynamic security
- tested per role
I build portals where access is enforced in the data model, not hidden in the report. Each person signs in and sees only what they are cleared to see.
Most portfolio reporting still goes out as a spreadsheet. Someone hides the tabs one investor should not see. Someone forgets once. One wrong send shows another investor's numbers.
Hiding a page in a report does not fix that. Security that holds has to live in the data model, where it applies to every report and every query.
All of it runs on the Microsoft data stack you may already own.
Each person's rows are filtered by who signs in. Funds, properties, and entities they are not cleared for never reach their screen.
Sensitive columns, like NOI or distributions, can be hidden from some viewers entirely. Not blanked out in a visual. Not there.
Access is driven by a mapping table. Add an investor or move a fund, and the view changes with it. No rebuilding a report per person.
The security design is documented and checked before anyone outside your team signs in, so you can show who sees what.
One table lists each user and the funds or entities they are cleared for. It is the single source of truth for access.
Security roles filter the data using that table. The filter runs on every query, whichever report or page the person opens.
Before launch, I view the portal as each role and check the numbers against your source. Then your team signs off.
If everyone can see everything, you do not need this. A standard Power BI build covers it, and I will tell you so.
No 80-page statement of work to start. We scope tight, ship something real, then expand.
30 minutes to understand your data, your stakeholders, and what "done" looks like. You leave with a clear recommendation.
A real, secured dashboard on your actual data within the first couple of weeks, so we react to something live instead of a slide deck.
Security tested, refresh automated, documented. It keeps running whether or not I'm in the room.
You define roles in the data model, each with a filter rule written in DAX. When someone opens a report, Power BI applies the filter for their role before any data comes back. They cannot see rows outside it.
No. Hiding a page only changes what the menu shows. Row-level security limits what data the model returns at all.
Yes. External investors can be invited as guest users through Microsoft Entra ID, or the portal can be embedded in a site you control. The right route depends on your licensing and how many viewers you have. I check that on the scope call.
Often, yes. Row-level security applies to viewers. People with edit-level access to the workspace can bypass it, so I set workspace roles with that in mind.
No. Row-level security works in Power BI on its own. Fabric adds options for storing and preparing the data, and I use it when it fits what you already run.
You see a real, secured dashboard on your own data within the first couple of weeks after kickoff.
Tell me what you're working with and who needs to see it. If I can help, I'll tell you how. If I can't, I'll tell you that straight.
Book a 30-minute call