Forum Discussion
Row-Level Security and AD groups
I've now successfully set this up.
I have 2 AD groups, both contain all users in the organisation. This means I don't need to assign permissions to individuals on the report server, I just add the 2 AD groups to one role each in the RLS security page.
One role is based on a hierarchy built from managers and their direct and indirect reports and the other role is based on departments within the organisation, e.g. where the user isn't a manager but needs access to data from a specific department.
These 2 roles have dax filters looking up the USERPRINCIPALNAME and matching it to data in separate datasets. If a user is in one of the datasets they will see data accordingly and if they are in both they will see the appropriate data from both.
Is this a new feature? I have had issues where when a user belongs to multiple roles they do not see anything.
It would be nice for the more permissive rule to win over the restrictive rules, however I have not experienced this.
I am using dynamic USERPRINCIPALNAME() only and members in an Active Directory.
I didn't put any user in 2 roles individually. I created 2 AD groups, both containing all users, then added the AD groups to one role each in the role level security page for the report.
When I tried adding individual users to 2 roles it gave an error, but if you add different AD groups and put the same user in both groups it works.