topic Re: RLS using just AD groups in Report Server

RLS using just AD groups

darylmitchell — Tue, 02 Nov 2021 14:32:42 GMT

I want to use AD groups for RLS security but it seems I can only use Email enabled AD groups.

Is it possible that none Emailed enabled groups can be used?

Re: RLS using just AD groups

lbendlin — Wed, 03 Nov 2021 13:55:26 GMT

For RLS to work you need to somehow identify the report viewer. Usually that is a person which has an email address.

You can now apply RLS directly to the email address, or you can have roles that contain distribution lists / AD groups that include that email address .

I don't see a way to do this without email addresses.

Re: RLS using just AD groups

darylmitchell — Wed, 03 Nov 2021 14:00:30 GMT

Our MS environment developers have implemented a single signon that doesn't seem to allow email enabled Ad groups.
Just Groups without Email addresses.
Is there anyway we use just AD groups?

Re: RLS using just AD groups

d_gosbell — Thu, 04 Nov 2021 01:39:43 GMT

darylmitchell wrote:

Is there anyway we use just AD groups?

There is no such thing as "just an AD group" there are 2 main types of groups. Distribution groups and security groups. You can only assign security rights to security groups. It sounds like you might be trying to assign security based on a distribution group. If this is the case you will either need to get your AD administrators to change the group into a mail enabled security group or get them to setup a new security group.