topic Re: Access control using organisation Active Directory in Service

Access control using organisation Active Directory

paullondon — Thu, 18 Mar 2021 11:51:19 GMT

Hi All,

A client would like to control access to Power BI using existing Active Directory Roles within their organisation.

For example, they could create roles called bi_sales, bi_operations, bi_management. And then tell Power BI to allow access to content (workspace, reports or dashboards) to specific user roles. This way they do not have to come into Power Bi and Share with specific people. The publisher/admin would simply publish a report and configure Power BI to allow access to say bi_operations and bi_management only.

Is this possible?

I understand we could connect to AD and import all users and groups but that is a solution for RLS more than overall access to the content itself.

Apologies if this has been covered before. I am struggling to get a good steer on how this works.

Many thanks,

Paul

Re: Access control using organisation Active Directory

lbendlin — Thu, 18 Mar 2021 19:16:34 GMT

It is possible, at least partially.

You can use AD distribution lists to grant access to apps, reports and dashboards.

You can also use AD distribution lists to control membership in RLS roles (*). That allows you to fine tune the access not just on report level but on individual row level.

In addition, OLS (object level security) has been announced recently and might also help you control acces on an intermediate level.

* (or use AD controlled reference tables with individual access rights)

Re: Access control using organisation Active Directory

paullondon — Wed, 24 Mar 2021 10:51:52 GMT

Many thanks. Would you have a link to a Doc on this as I cannoot find such examples within the Microsoft Docs.

Re: Access control using organisation Active Directory

lbendlin — Wed, 24 Mar 2021 11:46:22 GMT

Check RADACAD - they have many articles where this topic is covered.