Object Level Security (OLS) in Power BI: Hide Tables and Columns With TMDL View

Many guides still say you need Tabular Editor to set up OLS in Power BI. It works, but you install an external tool just to change one permission. Power BI Desktop’s TMDL view now does it with a short script: a role with metadataPermission: none on the table or column.

Object level security (OLS) hides whole tables or single columns from people in a role. For them, the object simply doesn’t exist.

In this tutorial, we’ll use the object level security Power BI Desktop now supports in TMDL view, for one column and then a whole table. Then we’ll test both roles and compare RLS vs OLS.

The Sample Model We’ll Use

I’m using the same Power BI file as my RLS demo, with three tables loaded from my demo CSV files. New to building reports? Start with creating a report in Power BI Desktop.

• Sales: 60 orders from January to September 2026, $165,701 in total.
• Targets: one 2026 target per region (East $75,000, West $70,000, South $15,000, Central $5,000).
• Sales Reps: five reps with their work email.

SalesRep	Email	Total Sales
Adele Vance	adele.vance@spguides.com	$16,454
Alex Wilber	alex.wilber@spguides.com	$9,700
Lee Gu	lee.gu@spguides.com	$48,630
Megan Bowen	megan.bowen@spguides.com	$46,099
Nestor Wilke	nestor.wilke@spguides.com	$44,818

Sales links to Targets on Region and to Sales Reps on SalesRep. It’s the same Sales table behind my Power BI percentage of total by category tutorial. We’ll hide Email from one role and Targets from another:

Method 1: Hide a Column With OLS in TMDL View (Recommended)

Use this when a table is fine to share but one column isn’t, like an email or salary. TMDL view is generally available in Power BI Desktop, so there’s nothing to install.

1. Select the TMDL view icon in the left rail (below DAX query view).
2. Paste the script below into the script tab.
3. Select Preview, then Apply.

createOrReplace

    role 'Hide Rep Email'
        modelPermission: read

        tablePermission 'Sales Reps'
            columnPermission Email
                metadataPermission: none

How does this work?

createOrReplace creates the role, and modelPermission: read gives normal read access. The OLS part is metadataPermission: none under columnPermission Email, which hides that column and its name. Set it to read to keep it visible, and wrap names that contain spaces in single quotes, like 'Sales Reps'.

Preview shows the new role in green (lines 631-637), under the existing row level security in Power BI role:

After Apply, the green bar confirms the role is saved. No Manage roles step is needed.

Pro Tip: Keep each OLS role in its own script tab. Power BI Desktop saves TMDL view tabs in the .pbix, so you can reopen and re-run them later.

Method 2: Hide a Whole Table With OLS

Same model, new script tab. This time we hide the regional targets. Targets is a good candidate because it sits at the end of the relationship chain, not in the middle:

createOrReplace

    role 'Hide Targets'
        modelPermission: read

        tablePermission Targets
            metadataPermission: none

How does this work?

With metadataPermission: none directly under tablePermission Targets, the whole table is hidden. Microsoft notes that measures referencing a secured table are hidden too. There’s no setting to secure a measure directly, so this is the way to hide one.

So my % of Target measure from the percentage of two columns in Power BI post disappears for this role:

% of Target = DIVIDE([Total Sales], [Total Target])

Test OLS Roles With View As

On the same report, page 5 has a table with SalesRep, Total Sales and Email. Select Modeling > View as, check Hide Rep Email and select OK.

Both new OLS roles appear next to the RLS roles: None, Other user, East and West, East Region, Hide Rep Email, Hide Targets and Sales Rep Own Data. You can test any of them without publishing.

The whole visual breaks; it doesn’t just drop the column. Email turns red in the Columns well, and searching the Data pane for Email finds nothing:

See details names the field. It’s the same message as for a deleted field, so viewers can’t tell it exists:

With Hide Targets, the Data pane lists only Sales and Sales Reps, and % of Target is gone from the Sales table. Select Stop viewing to return to your own view:

Important: because a secured field breaks the whole visual, give restricted users their own visuals or pages that don’t use secured fields. For example, a copy of the Sales by Rep table without the Email column.

Assign People to OLS Roles in the Power BI Service

Roles do nothing until people are in them. Per Microsoft’s docs:

1. Publish the report from Power BI Desktop to a workspace.
2. In the Power BI service, select More options (…) on the semantic model.
3. Open Security and add people or groups to each role.

OLS applies only to workspace Viewers; Admins, Members and Contributors can edit the model, so they still see everything. My demo stayed in Desktop, so there are no screenshots of these steps. Sharing in SharePoint? See embedding a Power BI report in SharePoint Online.

Method 3: Set Up OLS With Tabular Editor

If Tabular Editor is already in your workflow, it writes the same metadataPermission setting. You just don’t get the TMDL preview, and you need the tool installed:

1. Create the role in Modeling > Manage roles.
2. Select External tools > Tabular Editor.
3. Under Roles > Table Permissions, set the table or column to None.
4. Save, publish and assign members.

RLS vs OLS in Power BI

People often ask about RLS and OLS in Power BI together, because both live in roles. They hide different things, though, and you’ll often use both in one model:

	Row level security (RLS)	Object level security (OLS)
Hides	Rows (East Region sees $81,686 of orders)	Whole tables or columns
Defined with	A DAX filter in Manage roles	metadataPermission: none
Dynamic per user	Yes, with USERPRINCIPALNAME()	No; depends on role membership
Viewers see	Fewer rows	Broken visuals, missing objects

For per-user filters, see USERNAME() and USERPRINCIPALNAME() in Power BI. More guides are on our Power BI tutorials page.

Things to Keep in Mind

• Which method: Method 1 for a column, Method 2 for a table, Tabular Editor only if you already use it, and RLS for per-user rows.
• Don’t mix roles: RLS and OLS from different roles cause a query-time error. Put both in one role.
• Don’t secure a middle table: table OLS can’t break a relationship chain (A to B to C).
• Editors aren’t affected: Admins, Members and Contributors see everything. Test with a Viewer.
• Unsupported features: Q&A, Quick insights, Smart narrative and the Excel Data Types gallery. Our Power BI DAX functions with examples list covers the DAX used here.

These posts use the same 2026 sales model, so they’re a good next read:

• How to Calculate Percentage of Rows in Power BI
• 6 Various Power BI Matrix Multiple Columns Examples
• How to Add a Dropdown Slicer in Power BI
• Power BI Add Leading Zero to Month

Frequently Asked Questions