Adding user to AD group whenever approval request is accepted in powerbi services

[ANUPAM_BARLA]

Hi Microsoft Fabric Environment - Sharing across workspaces ,

When a user requests access to a Power BI report, and the request is approved in Power BI service, the user should be automatically added to a pre-existing Azure AD group. This process should eliminate the need for manual user addition through the IAM shop.

Is there a way to do it in power BI services directly?

Is there a way to do it through power automate or graph api ?

[Poojara_D12 · Accepted solution]

Hi @ANUPAM_BARLA 

There is no direct way in Power BI Service to add users to an Azure AD group automatically upon report access approval. However, you can achieve this using:

1. Power Automate:

   • Trigger a flow based on approval events or email notifications.
   • Use the Azure AD connector to add the approved user to the group automatically.

2. Microsoft Graph API:

   • Monitor Power BI activity logs or emails for approval.
   • Use the Graph API to add the user to the Azure AD group with a POST request to:

https://graph.microsoft.com/v1.0/groups/{group-id}/members/$ref
​

• Automate this with Power Automate or scripts.

Both methods require some setup but can fully automate the process.

Did I answer your question? Mark my post as a solution, this will help others!
If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 🙂

Kind Regards,
Poojara
Data Analyst | MSBI Developer | Power BI Consultant
Consider Subscribing my YouTube for Beginners/Advance Concepts: https://youtube.com/@biconcepts?si=04iw9SYI2HN80HKS 

[v-shamiliv]

Hi @ANUPAM_BARLA 

Thank you for reaching out microsoft fabric community forum.

you can’t directly add users to an Azure AD group from the "Manage Access" section.

You could set up a flow in Power Automate to trigger whenever a report access request is approved. The flow can automatically add the user to the specified Azure AD group. This would reduce manual work and make the process more efficient.

If you're comfortable with scripting, the Microsoft Graph API offers a way to automate the process of adding users to an Azure AD group. This can be implemented using a script in PowerShell or Python, which can seamlessly integrate with your existing workflows.

If you need any further assistance or have any questions, please feel free to contact us.

If this solution helps, please consider giving us Kudos and accepting it as the solution so that it may assist other members in the community.

Best regards,
 Shamili.v

[lbendlin]

Which group? There may be multiple groups listed in the audience access.

If this is important to you please consider voting for an existing idea or raising a new one at https://ideas.fabric.microsoft.com

[ANUPAM_BARLA]

The group I'm interested in is the security group (Azure Active Directory group) that we've already added to the workspace as a viewer group. When we add a user to this group through IAM Shop, it directly reflects in the viewer group, granting access.

However, the issue arises when a new user directly requests a report. This request goes to Power BI services, where we don't have the option to add the user to our specified group. There should be an option to directly add the user to this group.

For example, in the manage access section, we can either add people or groups. We've already added a group, but if I want to add a person to this group, I can't do it. What I want is an option to "add people to a group" as well.