1. Implementing Row Level Security in SQL Server
Louis Davidson, Data Architect, CBN

2. Data Architect; CBN, drsql.org
Book Author
Written 6 books on database design, along with parts of other books on DMVs, Exam Refs, MVP Deep Dives, etc.
Corporate Data Architect
Worked for the same company for 20 years, which has allowed me a breadth of technology experience.
Louis Davidson
Data Architect; CBN, drsql.org
Microsoft Data Platform MVP
Though I still like to call it SQL Server MVP, because I am that conservative (also known as old).
/louisdavidson
@drsql

3. What is Row Level Security?
Hiding rows from users based on some context
Implement a predicate to hide rows based on inclusion in a role, or name, or even application/time period.
Unlike most security, dbo/sa are not immune to it’s effects (unless desired)
Is a form of Horizontal Partitioning
Filters out rows that do not meet a security oriented predicate
A primary goal will be to limit effect on the application

4. Row Level Security Example
All Data In Table
CustomerId
Name
SalesTotal
ManagedBy 1
Betty’s Bikes
Fred 2
Cy’s Cycles 3
Tom’s Ten Speeds
Linda 4
Paula’s Penny-farthings
200.00
Say our predicate is: USER_NAME() = ManagedBy

5. Row Level Security Linda’s View 3 Tom’s Ten Speeds 560020.00 Linda 4
CustomerId
Name
SalesTotal
ManagedBy 3
Tom’s Ten Speeds
Linda 4
Paula’s Penny-farthings
200.00

6. Row Level Security Fred’s View 1 Betty’s Bikes 200000.00 Fred 2
CustomerId
Name
SalesTotal
ManagedBy 1
Betty’s Bikes
Fred 2
Cy’s Cycles

7. Row Level Security Everyone Else’s View (Including SA and db_owner)
CustomerId
Name
SalesTotal
ManagedBy

8. Demo Agenda
We will be covering how to implement row level security using SQL Server methods, as well as other timeless methods
Define row level security
Using the Row Level Security (RLS) Feature
The mechanics of implementing RLS
Performance/scaling considerations
Row level security without the feature
Bonus: Dynamic Data Masking

9. Row Level Security Feature
Predicate Function
Simple Table Valued UDF that returns either nothing (to not allow access) or something (to allow access)
UDF parameters usually map to one or more columns in the table.
Security Policy
Attaches the predicate function to a table
Predicate functions can be applied to:
Filter our data from the user’s view
Block a user from performing some action

10. Demo Time!
Row Level Security

11. Learn more from Louis Davidson
@drsql