Forum Discussion
RLS with nested AAD groups
Hi GiudiDavi,
Power BI does not expand nested Azure AD group membership for RLS evaluation.
Only direct membership is considered.
This means:Adding the parent AAD group to the ALL role will give full access only to the direct members (Person A and Person B).
Members of the child groups will not inherit access to the ALL role, even though their groups are nested inside the parent group in Azure AD.Nested group expansion is not supported in Power BI’s RLS resolution process.
Recommended RLS Configuration
Role: ALL = Assign the parent AAD group.Role: Group 1 = Assign sonAADgroup1.Role: Group 2 = Assign sonAADgroup2.With this configuration:- Person A and Person B (direct members of the parent group) will see all data.
- Members of sonAADgroup1 will only see Group 1 data.
- Members of sonAADgroup2 will only see Group 2 data.
- Child group members will not receive full access through inheritance.
This configuration is correct and safe for your requirement.Also, check this topics resolved in order to get more context:
Super UserHi GiudiDavi,
Power BI does not expand nested Azure AD group membership for RLS evaluation.
Only direct membership is considered.
This means:
Adding the parent AAD group to the ALL role will give full access only to the direct members (Person A and Person B).
Members of the child groups will not inherit access to the ALL role, even though their groups are nested inside the parent group in Azure AD.
Nested group expansion is not supported in Power BI’s RLS resolution process.
Recommended RLS Configuration
Role: ALL = Assign the parent AAD group.
- Person A and Person B (direct members of the parent group) will see all data.
- Members of sonAADgroup1 will only see Group 1 data.
- Members of sonAADgroup2 will only see Group 2 data.
- Child group members will not receive full access through inheritance.
can you please confirm taht the visibility of objects inside the workspace is inherited?
if i gave my fathergroup viewer role on the workspace then someone inside the songroupA access power bi they will see the workspace
