Set Up Row-Level Security for Procore Analytics

Objective

To set up row-level security for Procore Analytics.

Background

If a user's Procore login credentials are the same as their Power BI login credentials, row-level security (RLS) filters can be set up in Power BI Desktop to limit a user's access in the Power BI service to data only from Procore projects they have been added to. For more information, see Microsoft's Row-level security (RLS) with Power BI icon-external-link.png.

Things to Consider

Steps

  1. Configure 'Project' and 'ProjectUser' Power BI Relationship
  2. Create a New RLS Role
  3. Add Users to a RLS Role

Configure 'Project' and 'ProjectUser' Power BI Relationship

Configuring a Power BI relationship between the Project and ProjectUser tables connects the data from these tables. See Microsoft's Create and manage relationships in Power BI Desktop icon-external-link.png. Two options for configuring this relationship are outlined below.

Option 1

  1. Open a Procore Analytics report in Power BI Desktop.
  2. On the Home tab, click Manage Relationships.
  3. In the 'Manage relationships' window, scroll through the options and select ProjectUser (ProjectID) and click Edit.

    procore-analytics-rls-manage-relationships.png
     
  4. Complete the following in the 'Edit relationship' window:
    • Under 'Cardinality', select Many to one (*:1) and mark the 'Make this relationship active' checkbox. These options should be selected by default.
    • Under 'Cross filter direction', select Both and mark the 'Apply security filter in both directions' checkbox.

      procore-analytics-rls-edit-relationship.png
       
  5. Click OK to close the 'Edit relationship' window.
  6. Click Close to close the 'Manage relationships' window.
  7. Save the report.
  8. Continue with the steps in Create a New RLS Role.

Option 2

  1. Open a Procore Analytics report in Power BI Desktop.
  2. Click the Model view.

    procore-analytics-rls-model.png
     
  3. Check the relationship between the 'Project' and 'ProjectUser' tables. The relationship should have a (1) next to the 'Project' table and an asterisk (*) next to the 'ProjectUser' table.
     Tip
    To only view the relationship betweeen the 'Project' and 'ProjectUser' tables (as shown below), click the plus icon (+) next to the 'All tables' tab to create a new layout and add the 'Project' and 'ProjectUser' tables to the layout by dragging and dropping them from the Properties > Fields menu into the gray space.

    procore-analytics-rls-relationship-model.png
     
  4. Select the relationship by double-clicking on the connecting line between them.
  5. Complete the following in the 'Edit relationship' window:
    • Under 'Cardinality', select Many to one (*:1) and mark the 'Make this relationship active' checkbox. These options should be selected by default.
    • Under 'Cross filter direction', select Both and mark the 'Apply security filter in both directions' checkbox.

      procore-analytics-rls-edit-relationship.png
       
  6. Click OK to close the 'Edit relationship' window.
  7. Save the report.
  8. Continue with the steps in Create a New RLS Role.

Create a New RLS Role

  1. On the 'Modeling' tab, click Manage Roles.
  2. In the 'Manage roles' window, complete the following in each column:
    • In the 'Roles' column, click Create and enter a name for the role in the 'New role' field. Project User is the role name used in the image below.
    • In the 'Tables' column, select ProjectUser.
    • In the 'Table filter DAX expression' column, enter [email_address] = userprincipalname().

      procore-analytics-rls-manage-roles.png
       
  3. Click Save in the 'Manage roles' window.
  4. Save and publish the report.
  5. Continue with the steps in Add Users to a RLS Role.

Add Users to a RLS Role

Once the RLS table relationship is configured, users must be added to RLS roles in the Power BI service in order to view a Procore Analytics report. For more information, see Microsoft's Row-level security (RLS) with Power BI: Working with members icon-external-link.png.

  1. Open a Procore Analytics report in the Power BI service.
  2. Under 'Datasets', click the ellipsis (...) next to the report you want to set up RLS for and click Security.
  3. Select the role you want to add one or more users to.
     Tip
    Using Office 365 Distribution Groups can simplify the process of adding multiple users to an RLS role at one time. See Microsoft's Get started with Microsoft 365 Groups in Outlook icon-external-link.png.
  4. Enter their email addresses and click Add.
  5. Click Save.

See Also