RLS with nested AAD groups

[GiudiDavi]

Hi all!
my situation it that i have this kind of structure:

father AAD group --> (person A, personB, sonAADgroup1, sonAADgroup2)

the two son AAD group had people in it

i have some rule on my semantic model:
ALL
group 1 --> with sonAADgroup1 in it
group 2 --> with sonAADgroup2 in it

where i should add my father grupo to let people A and B to see everythin?

my doubt is that if i do a thing like that: 
ALL --> with fatherAAD in it
group 1 --> with sonAADgroup1 in it
group 2 --> with sonAADgroup2 in it
then sonAADgroup1 and sonAADgroup2 will see everything because they are in the father, and father can see all

[Kedar_Pande]

@GiudiDavi 

Correct structure:

ALL role → father AAD group (A, B, son1, son2)
Group1 role → sonAADgroup1 only 
Group2 role → sonAADgroup2 only

AAD nesting expands members transitively. Sons get ALL + their specific role = unrestricted access. Use separate non-nested groups for A/B if needed.

[Zanqueta · Accepted solution]

Hi @GiudiDavi,

Power BI does not expand nested Azure AD group membership for RLS evaluation.
Only direct membership is considered.
This means:

Adding the parent AAD group to the ALL role will give full access only to the direct members (Person A and Person B).
Members of the child groups will not inherit access to the ALL role, even though their groups are nested inside the parent group in Azure AD.

Nested group expansion is not supported in Power BI’s RLS resolution process.

Recommended RLS Configuration

Role: ALL = Assign the parent AAD group.

Role: Group 1 = Assign sonAADgroup1.

Role: Group 2 =  Assign sonAADgroup2.

With this configuration:

• Person A and Person B (direct members of the parent group) will see all data.
• Members of sonAADgroup1 will only see Group 1 data.
• Members of sonAADgroup2 will only see Group 2 data.
• Child group members will not receive full access through inheritance.

This configuration is correct and safe for your requirement.

 

Also, check this topics resolved in order to get more context:

 

Solved: RLS and OLS using AAD groups - Microsoft Fabric Community

Solved: Dynamic RLS based on sub group - Microsoft Fabric Community

[GiudiDavi]

can you please confirm taht the visibility of objects inside the workspace is inherited?
if i gave my fathergroup viewer role on the workspace then someone inside the songroupA access power bi they will see the workspace