Compliance Issue with Power BI Sharing via AD Groups

[Mar1604]

Hi, maybe one of you knows the answer on my problem or point me out to the right direction.

We are using AD Groups to share Power BI Apps, Power BI Reports, Power BI Semantic Models etc. We can manage these AD groups very well with the use of a Power BI Report, so we can exactly see who is in which group. 

However I have received a question from our internal Audit department that I have to show them which group has access to which App, Report, Semantic Model etc. However I can't find any solution that shows me this and for me it's undoable to go through all the thousands of Apps, Reports, Semantic Models and check this manualy. Is there any solution available or could someone point me out to the rigth development department from Microsoft? 

(So I'm not interested in who is in which group, that's been covered, but I need to know what the access rights are from this

[Mar1604]

Hi @collinq , maybe I'm very bad in explaining what I need, because I already use the API you mention above. And yes that API gets the users in the Group. But if I have a certain group AAD- 1 and I want to know on which Workspaces, datasets and dataflows I have used this AAD group. So my selection is group AAD-1, which Access does this group has?

[collinq]

Hi @Mar1604 ,

I think that if you run the reports from API that we are discussing you can combine them.  BUT, if you want to run for a specific user (or AD Group), then I would use the GetUserArtifactAccessAsAdmin as this "Returns a list of Power BI items (such as reports or dashboards) that the specified user has access to."

Does that one work for your needs?

[Mar1604 · Accepted solution]

Hi Colin, I will ask someone to give it a try (or figure out myself if this works).

Thank you for helping out.

[Mar1604]

Hi @collinq,

But that's not my question. I can get all the Groups and I can get all the users that are in that group. However what I need is when I have one specific group, to which Workspaces, semantic models or Power BI dataflow has this group access. So what's the autorisation that this group as a group has within Power BI.

[collinq]

Hi @Mar1604 ,

If you use the REST API you can see who has which permissions to what.  Specifically, I am thinking about "Getappusersasadmin" and "Getdashboardusersasadmin" and so on.  The list can be found here: Power BI REST APIs for embedded analytics and automation - Power BI REST API | Microsoft Learn

[Mar1604]

Hi @collinq, If I'm not mistaken those API's are working for individuals, but you can't track down the autorisations that a group has. But I will ask my colleague to give it a try. Thanks for you answer, I will let you know if it works.

[collinq]

Hi @Mar1604 ,

Well, I think that the API gets the "users" list.  If you have an AD group as a user then it will be listed as well.  To get all of the users within a specific AD group the Entra Administrator will have to give you the list of users assigned to each AD group.