RLS using just AD groups

[darylmitchell]

I want to use AD groups for RLS security but it seems I can only use Email enabled AD groups.

Is it possible that none Emailed enabled groups can be used?

[darylmitchell]

Our MS environment developers have implemented a single signon that doesn't seem to allow email enabled Ad groups.  
Just Groups without Email addresses.
Is there anyway we use just AD groups?

[d_gosbell · Accepted solution]

---

@darylmitchell wrote:

Is there anyway we use just AD groups?

---

There is no such thing as "just an AD group" there are 2 main types of groups. Distribution groups and security groups. You can only assign security rights to security groups. It sounds like you might be trying to assign security based on a distribution group. If this is the case you will either need to get your AD administrators to change the group into a mail enabled security group or get them to setup a new security group.

[lbendlin]

For RLS to work you need to somehow identify the report viewer. Usually that is a person which has an email address.

You can now apply RLS directly to the email address, or you can have roles that contain distribution lists / AD groups that include that email address .

I don't see a way to do this without email addresses.