For row-level security (RLS) to function correctly across a bidirectional relationship, two conditions must be met. First, the relationship must be active to allow filters to propagate between the tables by default. Second, the "Apply security filter in both directions" option must be enabled for that relationship. This specific setting ensures that the RLS filter applied to one table is also propagated to the related table, enforcing the security rules regardless of which table is being filtered first. This is crucial when both tables in the relationship have RLS rules defined.

A. Assume referential integrity is a performance optimization setting for relationships; it does not control the direction or application of security filters.

B. An inactive relationship does not propagate filters unless explicitly invoked by a DAX function, and Assume referential integrity is irrelevant to RLS.

C. An inactive relationship prevents automatic filter propagation, which contradicts the requirement for standard bidirectional cross-filtering to work with RLS.

1. Microsoft Learn. (2023). Row-level security (RLS) with Power BI.

Section: RLS with bi-directional cross-filtering

Content: "By default

RLS filtering uses single-directional filters

whether the relationships are set to single direction or bi-directional. You can manually enable bi-directional cross-filtering with RLS by selecting the relationship and checking the Apply security filter in both directions checkbox." This directly supports enabling the specific setting on an active relationship.

2. Microsoft Learn. (2023). Model relationships in Power BI Desktop.

Section: Relationship properties

Content: The documentation describes the "Apply security filter in both directions" property

explaining that when enabled for a relationship with a "Both" cross-filter direction

it propagates the security context to the related table. This is the exact mechanism required by the question.

3. Microsoft Learn. (2023). Bidirectional cross-filtering.

Section: Row-level security

Content: "When a DAX expression for a row-level security (RLS) rule is active

it will also filter in the other direction. ... You must enable the Apply security filter in both directions property for the relationship." This confirms that for RLS to work bidirectionally

this property is mandatory.