Dynamic row level security roles can be implemented in DirectQuery models via relationships and with specifically bidirectional cross-filtering between user security tables and the dimension tables to be secured. DAX information functions, commonly used in the role security expressions of import mode models, such as CONTAINS() and LOOKUPVALUE(), are not supported in DirectQuery mode models, thus requiring a relationship-based security design. However, though limited to this single approach, dynamic security can be developed for DirectQuery models quickly and maintained easily, given the avoidance of complex DAX security expressions.

This recipe walks through the essential steps and settings necessary to support dynamic security in a DirectQuery model. Additional details describing the filter context applied by the security role...