Forum Discussion
AD group access issue for embedded reports
Hello devJC
Thank you for your patience and for the detailed analysis you’ve provided. Based on your findings and our investigation, we can confirm that Power BI caches AD group memberships for embedded users, and this cache is only refreshed when users manually log in to the Power BI service.
Since Power BI does not provide an automatic refresh mechanism for AD group permissions in embedded scenarios, we recommend the following approaches:
Manually Remove and Re-Add the AD Group to the App Audience. This is a workaround that can be tested manually first. Removing and re-adding the AD group forces Power BI to re-evaluate group membership. If successful, proceed with automating the process using the Power BI REST API or Power Automation.
If you need any further assistance, feel free to reach out.
Thank you.
Anonymous,
I have reviewed both of your responses and I have verified each of the points. Our problem does not seem to be a token issue. Here is our token acquisition process:
- User is onboarded to AD group in advance
- After waiting several days, the user logs into the application
- Using the MSAL library for React, we request a new token with the method acquireTokenSilent and set the scope to https://analysis.windows.net/powerbi/api/.default
- Permissions present in the token are App.Read.All, Dashboard.Read.All, Dataset.Read.All, Report.Read.All, UserState.ReadWrite.All, and Workspace.Read.All
- Synchronization does not seem to be an issue since new users are able to directly log in to apps.powerbi.com and access authorized content available for their group
Still, access to embedded report is restricted:
- Reports do not use RLS, only different audiences at the App level
- Acquiring a new token days (or weeks) after being added to the AD group or after calling RefreshUserPermissions endpoint has no effect
- Users can access embedded reports normally after directly logging into apps.powerbi.com
- Users can access embedded reports weeks after being removed from the AD group and up until they directly log into apps.powerbi.com
- Users added/removed individually to the App (not AD group) do not experience the embed issue
The most likely culprit is your comment:
Power BI caches user permissions, and when a user logs in, their credentials and permissions are validated against the Azure AD group memberships.
I will be testing removing/readding the user group audience to the app in powerBI to test if that forces a refresh.
If PowerBI caches AD group members/permissions and does not automatically refresh those permissions until a user manually logs in, then this effectively breaks embedded reports that use AD groups to manage access. In response, we will require some configuration to manage an automatic refresh AD group members/permissions within PowerBI on a schedule until this problem is resolved. Are there any examples of how to accomplish this?
Thank you.
Hello devJC
Thank you for your patience and for the detailed analysis you’ve provided. Based on your findings and our investigation, we can confirm that Power BI caches AD group memberships for embedded users, and this cache is only refreshed when users manually log in to the Power BI service.
Since Power BI does not provide an automatic refresh mechanism for AD group permissions in embedded scenarios, we recommend the following approaches:
Manually Remove and Re-Add the AD Group to the App Audience. This is a workaround that can be tested manually first. Removing and re-adding the AD group forces Power BI to re-evaluate group membership. If successful, proceed with automating the process using the Power BI REST API or Power Automation.
If you need any further assistance, feel free to reach out.
Thank you.
Hi devJC ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.Hello devJC ,
I wanted to follow up on our previous suggestions regarding the issue. We would love to hear back from you to ensure we can assist you further.
If my response has addressed your query, please accept it as a solution and give a ‘Kudos’ so other members can easily find it. Please let us know if there’s anything else we can do to help.
Thank you.
Hi Anonymous
May I ask for your help?
I have a very similar setup and problem: an embedded Power BI report (not using the Power BI app) and users in a group; the group is given permissions to the entire Power BI workspace.The difference is that users have been added to the group weeks ago, but they never logged into the Power BI workspace or never tried to access this embedded report.
Now they are trying to do so and get an Unauthorised error.
I tried to manually remove and re-add the group to the workspace, but this changed nothing.
However, when the user logs into the Power BI workspace, they become able to see the embedded report.
If I give direct permission to a specific user from my group to the whole Power BI workspace, and immediately remove it, the user also becomes able to see the embedded report, and they still can see it after local cache cleanup and after a few hours.Would you be able to suggest any idea on how to make all my current users in the group able to see the report? And also all future group members.
Thank you!
