Forum Discussion
Row Level Security when you have AD Groups
Generaly, AD groups (and users) you can use for assign report permission or report role. But for RLS rules you need work with AD users (using userprincipalname), not with AD groups.
In your case you have two options:
1) access control based on your existing AD groups (recommended), in this case you need create two RLS roles:
-first like "SeeEverything", without and RLS rules. To this role assign your AD B-group.
-second like "ShopDirectors", with RLS rule (you will need table with USER and SHOP collumn for shop directors, with RLS rule). And to this role assign your AD A-group
2) Without AD group dependency, create RLS role with RLS rule with table with USER and SHOP collumns for all users (from A or B group). To this role assign both A-group and B-group and maybe also Everyone (no matter, because access will be driven by RLS rule).
HI Nory ,
In my opinion ,what you need is Dynamic Row Level Security with Hierarchy .For Dynamic Row Level Security with Hierarchy case, you may refer to these blog:
https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi
https://www.blue-granite.com/blog/using-dynamic-row-level-security-with-organizational-hierarchies
Please understand that these links are provided “AS IS” with no warranties or guarantees of content changes, and confers no rights.
Best Regards
Lucien