Dataset row-level security (Deprecated)

Row-level security restricts access to data based on the characteristics of the person viewing the data. Within Sigma, you can filter what data is visible based on team membership or user email address.

Requirements

• You must have Can Edit access on the individual dataset.

Set up row-level security

To set up row-level security, perform the following tasks:

1. Create a dataset
2. Create a column with user-identifying filter criteria
3. Filter the column

Create a column with user-identifying filter criteria

Creating the right filter logic is the key to row-level security.

Sigma provides two functions that provide information about the current user:

• CurrentUserEmail returns the email of the user viewing the data.
• CurrentUserInTeam returns True if the current user is a member of any of the given teams.

Both functions can be used to filter data.

Before you start: This action is only available in Edit mode. To start editing, click Edit in the top right corner of the page.

1. Open the dataset’s worksheet tab.

2. Add a new column.

3. Enter a formula for your user-identifying filter criteria.

   The formula must produce logical (true/false) values.

Filter the column

After you have a column with your filter criteria set up, you can filter your dataset to only show the desired data.

1. Select the column.

2. Filter to only show rows where the value is True.

   This filters the dataset and any child documents to only show data when the current user matches the filter criteria.

3. Hide the filtered column.

Example

The following examples describe configuring RLS by user, RLS by team, and a combination.

RLS by user example

If you have a table with sales results and you want each salesperson to see only their results, set up row-level security.

First, you need to pull in the emails associated with each line of data in a Sales Results table. You can then create a column and set up the formula that tests for what data the viewer should see:

[Salesperson Email] = CurrentUserEmail()

This formula evaluates the emails in the column [Salesperson Email] and checks whether they match the email of the user currently viewing the dataset or its child document. The formula returns True for all rows where the current user’s email matches the salesperson email. You now have a test for what data should be shown to which user.

RLS by team example

If you want to set up row-level security based on team membership instead of user email, use the CurrentUserInTeam. This function checks to see if the current user viewing the data is part of any of the specified teams.

To set up team security, create a column that associates the data with the correct Sigma team. If the Southwest should only see data from California, Nevada, and Arizona, set up a column with that logic:

If( [Region] = “California”, “Southwest”,  [Region] = “Nevada”, “Southwest”,  [Region] = “Arizona”, “Southwest”)

This calculated column has the value Southwest for all rows of data that have the [Region] set to California, Nevada, or Arizona.

You can expand this logic to include all of the teams you want to test for, then create your filter column.

CurrentUserInTeam([Team])

This formula returns True for every row of data where the current user belongs to the team indicated in the corresponding row of the [Team] column. You now know which data should be shown to someone, based on what teams they are a member of.

RLS by team and user example

You can also set up filters to test for multiple conditions. For example, filter a sheet to show salespeople data only from leads that they own, but show all the data to sales managers:

( [Salesperson Email] = CurrentUserEmail() ) or ( CurrentUserInTeam(“Sales Manager”) )

This returns True for all rows when the viewer is in the “Sales Manager” team and returns True only for rows where the viewer email matches the Salesperson Email for all other viewers.