Forum Discussion
how to setup RLS for multiple AD group based on country
I have two tables , Table1 and Table2, Table1 is connected to all other table and my Table2 is user ad group table. and relationship between Table1 to Table2 is one-to-many. so one country person can not see other country data.
Note: my all user present in AD groups only..
RLS Role :
[email] = userprincipalname()
and I have added all the AD group in securty at dataset level.
its not working properly
could anyone please help me how to set up RLS for this ?
Hi! You have to have each individual's email address listed in your model with what country they are associated with. To assign the access in service once you publish the model you can use the AD group, but the model itself has to have everyone's individual email ID since that is what they login with.
3 Replies
Hi! You can assign AD groups to the roles in Service, but when you set up the RLS in desktop you need to use people's actual e-mail. When everyone logs in they are using their e-mail and that is what Power BI is looking to check against for RLS. So, you would create a list with all of the emails and the country they have access to, then when they login they will see that data. Here is a great article from RADACAD.
Dynamic Row Level Security with Power BI Made Simple - RADACAD
Hi audreygerred
Thank you for the resposnse
Is there any way I can create a table for where I nominate each AD group to country and when user will log in it will take directly RLS to that specific country onlyHi! You have to have each individual's email address listed in your model with what country they are associated with. To assign the access in service once you publish the model you can use the AD group, but the model itself has to have everyone's individual email ID since that is what they login with.
