Access control using organisation Active Directory

[paullondon]

Hi All,

A client would like to control access to Power BI using existing Active Directory Roles within their organisation.

For example, they could create roles called bi_sales, bi_operations, bi_management. And then tell Power BI to allow access to content (workspace, reports or dashboards) to specific user roles.  This way they do not have to come into Power Bi and Share with specific people.  The publisher/admin would simply publish a report and configure Power BI to allow access to say bi_operations and bi_management only.

Is this possible?

I understand we could connect to AD and import all users and groups but that is a solution for RLS more than overall access to the content itself.

Apologies if this has been covered before.  I am struggling to get a good steer on how this works.

Many thanks,

Paul

[lbendlin]

Check RADACAD - they have many articles where this topic is covered.

[lbendlin · Accepted solution]

It is possible, at least partially.

You can use AD distribution lists to grant access to apps, reports and dashboards.

You can also use AD distribution lists to control membership in RLS roles (*).  That allows you to fine tune the access not just on report level  but on individual row level.

In addition, OLS (object level security) has been announced recently and might also help you control acces on an intermediate level.

* (or use AD controlled reference tables with individual access rights) 

[paullondon]

Many thanks.  Would you have a link to a Doc on this as I cannoot find such examples within the Microsoft Docs.