Forum Discussion
Dynamic Row level Security for AD groups
"maintain 1000+ email id with their access level is not a correct solution "
Please explain why you think that way. Larger companies have User Access Management tools that can maintain profiles and AD groups (including bulk load, periodic auditing and auto cleanup) . Usually these tools provide datasets or dataflows that can then be consumed by Power BI developers for their dynamic RLS needs.
Hi lbendlin
We already have AD groups in place for each team which has employee email id. This way we have almost 100+Ad groups which has 1000+ emails.
Any update in the records happens on AD group and all the tools updates the security accordingly.
We want to use the same AD group for our report RLS but PBI is not recognizing it.
Maintainig / Delete/Update of these email id will not be easy task as same email id can be in multiple groups/team.
We have the below kind of table to be load on PBI where access will the key to connect with PBI Base table
AD_Group | Access |
UKI_Leads | UKI |
IND_Leads | IND |
Appreciate your help and support.
I forgot to mention that all your AD groups must be mail enabled. Use their email address in Power BI
Thank you lbendlin,
Yes all the AD groups are email enabled , Like [email protected] and when passed in PBI as a table and validated on Manage roles using USERPRINCIPALNAME() but PBI is not able to recoganize it as email id.
Takes [email protected] as a user but does not expandes to actual users in the group.Thank you
That's not what I meant, sorry to have been unclear. Your DLs have to be specified in the access control list for the Power BI app. For the RLS itself you need a feed from your AD or PDL management tool of choice with the full list of all PDL members.