QlikToDax

Section Access; LOAD ACCESS, USER.EMAIL, REGION ...; Section Application;

Section Access (data reduction) in Power BI

Section Access reduces data per user with a security table in the script. Power BI uses row-level security roles: DAX filters evaluated with the signed-in user's UPN, usually through a security table. OMIT maps to object-level security.

Partial / different approach Modeling Power BI service

Short answer: Load a security table (UserEmail, Region). Create a role with the filter Geo[Region] IN CALCULATETABLE(VALUES(Security[Region]), Security[UserEmail] = USERPRINCIPALNAME()). Assign groups to the role in the service, and test with View as.

What it does in Qlik

Section Access loads a hidden table of users and access levels. Reduction fields (upper-case names and values) link to the same fields in the data model. When the app opens, it holds only the rows the user may see. * means "all values listed in the section access table", not all values. OMIT hides whole fields. In Qlik Cloud, users are identified with USER.EMAIL (or USERID).

Qlik example

Qlik script
Section Access;
LOAD * INLINE [
ACCESS, USER.EMAIL, REGION
ADMIN, [email protected], *
USER, [email protected], NORTH
USER, [email protected], SOUTH
];
Section Application;

Geo: LOAD Upper(Region) AS REGION, Region FROM [lib://Data/geo.qvd] (qvd);

Power BI equivalent

Role filter on the Geo table (Modeling > Manage roles)

DAX
-- Security: disconnected table with UserEmail, Region
Geo[Region]
    IN CALCULATETABLE (
        VALUES ( Security[Region] ),
        Security[UserEmail] = USERPRINCIPALNAME ()
    )

Everyone sees everything (the * row)

Create a second role with no filter (for example "All regions") and put the admins in it. Members of several roles get the union of what each role allows.

Gotchas and behaviour differences

  • RLS only applies to users with the Viewer role or app/share access. Workspace Admins, Members and Contributors are not restricted.
  • Qlik's * means "all values listed in the table". A role with no filter means all rows. That's a subtle difference if the Qlik table didn't list every region.
  • USERPRINCIPALNAME() returns the UPN, which isn't always the email address. For guest (B2B) users it can return either their home address ([email protected]) or the guest UPN in your tenant (user_partner.com#EXT#@yourtenant.onmicrosoft.com), depending on how the guest was invited and how they sign in. Put a card with USERPRINCIPALNAME() in the report and have a real guest open it before you build the security table. Store both forms if you're unsure.
  • Test as role in the service can impersonate a user, but only with the name you type in, so it won't show you what a real guest's UPN looks like. Security groups that contain guests may not apply RLS as expected. Add guests to the role directly, or use dynamic RLS through the security table.
  • OMIT (hiding fields) maps to object-level security. Define it in Power BI Desktop's TMDL view or in an external tool such as Tabular Editor. It is not set in the Manage roles filter screen.
  • Test with Modeling > View as in Desktop and Test as role in the service.

Official documentation

Related pages

SET vSales = Sum(Sales); LET vToday = Today(); Variables (SET, LET and $-expansion) Qlik variables hold expressions, values and settings, and are expanded as text. Power BI splits these roles: measures for reusable logic, Power Query parameters for load settings, what-if and field parameters for user input, calculation groups for logic applied to many measures, and VAR inside DAX. Partial / different approach $Syn tables (automatic) Synthetic keys and associative linking Qlik links tables automatically on every field with the same name and builds synthetic keys when they share several fields. Power BI doesn't link on every shared name. Relationships are model objects (autodetect may suggest some from matching names at load, so check them), use a single column and have a direction, so migrations usually remodel to a star schema. No 1:1 equivalent LOAD * INLINE [ ... ]; Inline load (hard-coded tables) Inline loads define small tables in the script. In Power BI, use Enter data in the ribbon, a #table expression in Power Query, or DATATABLE in DAX. Direct equivalent

Spotted an error or a better pattern? QlikToDax is maintained by a working BI consultant; corrections are welcome via the About page. Last reviewed 2026-10-25.