Row-Level Security in Popular BI Tools — What It Costs

Row-level security is available in most major BI tools — but the tier you need to reach it, and what you pay to get there, varies enormously. Some vendors treat RLS as a standard feature included from day one. Others gate it behind enterprise plans that represent a 5–10x cost increase over their entry tier. If RLS is a requirement for your deployment (and if it should be, Chapter 1 covers the cases in detail), the pricing structure around it is a core part of your tool evaluation.

Short answer: Power BI includes basic row-level security at Pro ($14/user/month), but sharing secured reports with external users pushes you toward Fabric capacity at $5,000+/month. Tableau offers it at Standard through user filters, with centrally managed data policies included in Enterprise. Metabase requires Pro at $575/month. Klipfolio can filter dashboards per user, but has no enforced row-level security, and its own documentation says not to rely on that filtering for security. DashboardFox includes it on every plan from $99/month. Jump to the side-by-side table.

This chapter breaks down how five major platforms handle RLS — what they call it, where it sits in their tier structure, and what the actual cost looks like for a realistic team.

Power BI — Available, But Complex at Scale

Power BI does include row-level security, and at the Pro tier ($14/user/month as of 2025, up 40% from $10) you can configure RLS within Power BI Desktop and publish secured reports to the Power BI Service. For a team of internal analysts sharing reports with clear, static data boundaries, this works.

The complications emerge at scale. RLS in Power BI requires configuration inside the dataset using DAX expressions — a proprietary formula language that requires some technical familiarity. For dynamic RLS (filtering based on the current user's identity), you write DAX roles that reference the built-in USERPRINCIPALNAME() function, which returns the logged-in user's email address. Your data model then needs a relationship structure that can join that email address to the appropriate data scope.

This is manageable for a capable data analyst but not something a business user can configure independently. And there's a harder constraint for any scenario involving external users (clients, partners, anyone outside your Azure Active Directory): Power BI's built-in RLS only applies cleanly to internal Azure AD users. Sharing secured reports with external users typically means licensing them as guest users in your Azure tenant — which has its own cost and complexity implications.

For organizations needing to share RLS-secured content at scale with external audiences — the agency use case, the SaaS embedding use case, the client portal use case — Power BI's architecture pushes toward dedicated capacity. Microsoft retired the old Premium P-SKUs in favor of Microsoft Fabric capacity, and the F64 SKU starts at approximately $5,000/month. Pro tier is $14/user/month. Fabric F64 capacity is $5,000+/month. That's the jump you're looking at if your external-user RLS requirements become demanding. See our Power BI comparison for a fuller breakdown.

Tableau — Centralized RLS Requires Enterprise

Tableau has row-level security capabilities, but arriving at a clean, maintainable implementation is more involved than the headline feature description suggests. At the Tableau Standard tier, RLS is possible through calculated fields and user filters — but implementing it correctly requires understanding Tableau's data model, user functions, and how filters interact with extracts vs. live connections.

For the enterprise-grade, centrally managed RLS that most compliance-conscious buyers want — where policies are defined once and applied across workbooks without requiring individual report-level configuration — you're looking at Tableau Enterprise. Centralized policies run through Tableau's virtual connections and data policies, which are part of Data Management. Tableau enables them automatically on Enterprise and Tableau+ licenses. Since September 2024, Data Management is no longer sold as a separate add-on, so a Standard customer who needs data policies has to move the whole deployment to Enterprise.

Tableau Enterprise pricing: Creator at $115/user/month, Explorer at $70/user/month, Viewer at $35/user/month. A 25-user deployment of Explorers at the Enterprise tier is $1,750/month, with Data Management included. Compare that to Tableau Standard Explorer at $42/user/month for the same 25 users at $1,050/month, where centralized RLS management is limited. See our Tableau comparison for a detailed breakdown.

Metabase — The $575/Month Cliff

Metabase is the most instructive example of RLS as a tier-gating mechanism. Metabase calls their RLS feature "Data Sandboxing" — and it's a genuinely useful implementation of dynamic, attribute-based row-level security.

Data Sandboxing is not available on the Metabase Starter plan ($100/month for 5 users, $6/extra user). It requires Metabase Pro at $575/month for 10 users, $12 per additional user.

To be clear about the math: if you're on Metabase Starter at $100/month and you discover you need RLS, your upgrade path is to Pro — and your bill goes from $100/month to $575/month minimum, before you've added a single extra user. That's a $475/month jump for a feature that arguably should be available to anyone handling sensitive data, regardless of their plan size. For 25 users on Pro, you're at $575 + (15 × $12) = $755/month.

The open-source self-hosted version of Metabase has no Data Sandboxing at all — you'd need to implement data isolation at the database level yourself. See our Metabase comparison for the full picture.

Klipfolio — Per-User Filtering, but No Enforced Row-Level Security

Klipfolio Klips can personalize a dashboard per user. You assign user or company properties, reference them as variables in a dynamic data source, and each person sees data filtered to their value. Klipfolio's own blog describes a 200-user dashboard built this way. For client work, Klipfolio also supports separate client accounts, each with its own copy of the dashboards and data sources.

What it does not offer is row-level security as an enforced control. Klipfolio's documentation states that dynamic data sources should not be used to implement security, because variable values can be reached through other features such as permalinks. Its guidance for securing data is to create a separate data source for each audience, with the values fixed in the data source definition. That works for a handful of audiences and becomes hard to maintain across dozens of clients or departments.

For a single-audience dashboard this may not matter. For anyone who needs one report shared across many clients or user groups, with a guarantee that each sees only their own rows, there is no plan to upgrade to that adds it.

DashboardFox — Included in Every Plan

DashboardFox includes row-level security in every pricing tier, starting with Starter at $99/month. There's no upgrade required, no add-on to purchase, no enterprise contract to sign. The same Data Tags-based security system that a Scale tier customer uses is available to a Starter tier customer from day one.

This is a deliberate product decision. The view at DashboardFox is that data isolation is a fundamental requirement for any multi-user BI deployment — not an enterprise luxury. Gating it behind higher tiers means that the teams most likely to need it (smaller agencies, growing SaaS companies, SMBs with external reporting requirements) are exactly the ones priced out of accessing it.

The specifics of how DashboardFox's Data Tags system works are covered in Chapter 4. For now, the relevant point is the pricing position: RLS at $99/month, no conditions.

Buyers who ask about row-level security usually ask about single sign-on in the same breath, so here is where that stands. Multi-factor authentication for end users is available today through Cisco Duo, and native enterprise SSO (SAML 2.0 and OIDC) for end users is in development. If your requirement goes beyond row-level isolation to a server and database of your own, for a security review or regulated data such as PHI, see the deployment options and the security review kit.

Side-by-Side: RLS Availability and Cost

Why This Matters for Your Evaluation

If you're evaluating BI tools and RLS is a requirement — which it should be if you're sharing data with external users, operating in a compliance-sensitive vertical, or managing data for multiple departments or clients — the tier structure around RLS is a core pricing consideration, not a footnote.

The scenario that catches teams off guard: they evaluate a tool at the entry tier, find it fits their needs, adopt it, and then discover six months later that their growing external reporting use case requires RLS — which requires a tier upgrade they hadn't budgeted for. The $100/month decision becomes a $575/month decision. The $14/user decision becomes a $5,000/month decision.

Evaluating RLS availability and cost at the start of your tool selection is substantially cheaper than discovering the limitation after you've built a reporting infrastructure on top of it.

The savings calculator can help you model what your actual cost looks like across tools at your specific user count and requirements.