Forum Discussion
Row-Level Security and AD groups
I've now successfully set this up.
I have 2 AD groups, both contain all users in the organisation. This means I don't need to assign permissions to individuals on the report server, I just add the 2 AD groups to one role each in the RLS security page.
One role is based on a hierarchy built from managers and their direct and indirect reports and the other role is based on departments within the organisation, e.g. where the user isn't a manager but needs access to data from a specific department.
These 2 roles have dax filters looking up the USERPRINCIPALNAME and matching it to data in separate datasets. If a user is in one of the datasets they will see data accordingly and if they are in both they will see the appropriate data from both.
You can have users in multiple roles and you can apply conflicting roles to the same table. The more permissive rules will win over the more restrictive rules.
By the way, dynamic RLS is when you use USERPRINCIPALNAME mappings. your implementation is static RLS.
Is this a new feature? I have had issues where when a user belongs to multiple roles they do not see anything.
It would be nice for the more permissive rule to win over the restrictive rules, however I have not experienced this.
I am using dynamic USERPRINCIPALNAME() only and members in an Active Directory.
I didn't put any user in 2 roles individually. I created 2 AD groups, both containing all users, then added the AD groups to one role each in the role level security page for the report.
When I tried adding individual users to 2 roles it gave an error, but if you add different AD groups and put the same user in both groups it works.