Forum Discussion
Solved
RLS with nested AAD groups
Hi all! my situation it that i have this kind of structure: father AAD group --> (person A, personB, sonAADgroup1, sonAADgroup2) the two son AAD group had people in it i have some rule on my ...
Hi GiudiDavi,
Power BI does not expand nested Azure AD group membership for RLS evaluation.
Only direct membership is considered.
This means:Adding the parent AAD group to the ALL role will give full access only to the direct members (Person A and Person B).
Members of the child groups will not inherit access to the ALL role, even though their groups are nested inside the parent group in Azure AD.Nested group expansion is not supported in Power BI’s RLS resolution process.
Recommended RLS Configuration
Role: ALL = Assign the parent AAD group.Role: Group 1 = Assign sonAADgroup1.Role: Group 2 = Assign sonAADgroup2.With this configuration:- Person A and Person B (direct members of the parent group) will see all data.
- Members of sonAADgroup1 will only see Group 1 data.
- Members of sonAADgroup2 will only see Group 2 data.
- Child group members will not receive full access through inheritance.
This configuration is correct and safe for your requirement.Also, check this topics resolved in order to get more context:
Kedar_Pande
Super User
Super User
Correct structure:
ALL role → father AAD group (A, B, son1, son2)
Group1 role → sonAADgroup1 only
Group2 role → sonAADgroup2 only
AAD nesting expands members transitively. Sons get ALL + their specific role = unrestricted access. Use separate non-nested groups for A/B if needed.