Solved: RLS using just AD groups

darylmitchell · ‎11-02-2021

I want to use AD groups for RLS security but it seems I can only use Email enabled AD groups.

Is it possible that none Emailed enabled groups can be used?

d_gosbell · ‎11-03-2021

@darylmitchell wrote:

Is there anyway we use just AD groups?

There is no such thing as "just an AD group" there are 2 main types of groups. Distribution groups and security groups. You can only assign security rights to security groups. It sounds like you might be trying to assign security based on a distribution group. If this is the case you will either need to get your AD administrators to change the group into a mail enabled security group or get them to setup a new security group.

View solution in original post

darylmitchell · ‎11-03-2021

Our MS environment developers have implemented a single signon that doesn't seem to allow email enabled Ad groups.
Just Groups without Email addresses.
Is there anyway we use just AD groups?

d_gosbell · ‎11-03-2021

@darylmitchell wrote:

Is there anyway we use just AD groups?

There is no such thing as "just an AD group" there are 2 main types of groups. Distribution groups and security groups. You can only assign security rights to security groups. It sounds like you might be trying to assign security based on a distribution group. If this is the case you will either need to get your AD administrators to change the group into a mail enabled security group or get them to setup a new security group.

lbendlin · ‎11-03-2021

For RLS to work you need to somehow identify the report viewer. Usually that is a person which has an email address.

You can now apply RLS directly to the email address, or you can have roles that contain distribution lists / AD groups that include that email address .

I don't see a way to do this without email addresses.