Using Dynamic RLS with Azure Active Directory Groups- Tabular model

[AmiraBedh]

We are having an SSAS tabular cube and we are using a live connection.

So the definition of the Dynamic Row Level Security will be on the SSAS tabular cube.

We are having only the  Azure Active Directory Groups email to have build a dimension.

For each specific department (HR, Sales,...) the person viewing the report based on the department he is working on.

We are using DRLS because an employee can be working on two or more departments.

So an employee can belong to one or more Active Directory Groups

The current Department dimension we are modeling is like below :

DepartmentSK
ADEmail

and we are linking it to fact table Sales. The employee is directly linked to the fact table.

My question do we need the email address of all employees belonging to an Azure Active Directory Group?

Or we can just configure that using the Azure Active Directory Group email.

For security and data protection, the client is currently providing only the Azure Active Directory Group email.

[lbendlin · Accepted solution]

Dynamic RLS works with individual email addresses.  If you want to use AD groups you need to implement static RLS (which may not be supported in your scenario).

Dynamic RLS supports the case where an individual reports to multiple managers.

[AmiraBedh]

Is it possible to use the USEROBJECTID instead of the email ?

[lbendlin]

No, your only choice for dynamic RLS is USERPRINCIPALNAME which is the email of the AD object accessing the app/report/dataset.