Dynamic Level Security - Confusing with the process

[DebbieE]

Im currently working on Dynamic Security.

It all makes sense in desktop. You go to Security - Manage roles

and against the table with your email address in it create for example [EmailAddress] = USERPRINCIPALNAME()

All great because you only need to set one rule up

However when you publish into Service, You need to go to settings - Security and then basically, individually add every email into members.

This is obviously very time consuming, especially when you have hundreds of users and people are leaving and joining all the time.

I thought dynamic security was supposed to stop you having to individually add email addresses?

[v-easonf-msft · Accepted solution]

Hi , @DebbieE 

I  think you don't need to  to individually add email addresses .       

As mentioned in the document ,"You can add a member to the role by typing in the email address, or name, of the user, security group or distribution list you want to add. You cannot add Groups created within Power BI. You can add members external to your organization."

So it is suggest to  create an AD security group  contain the users you need and apply that in the role your created.

Best Regards,
Community Support Team _ Eason

[DebbieE]

Perfect,

Thank you I will add that into my best practice guidance for this one.

One more quick thing on this. If you do add a group, can you still test as role with the individual email addresses within that group?