Dynamic RLS using Azure AD Dynamic Groups

[AaronS]

We have several dynamic groups in Azure AD that we'd like to utilize for RLS, but PowerBI doesn't seem to be able to see those groups.

[v-zhangti · Accepted solution]

Hi, @AaronS 

You can use the following groups to set up row level security.

• Distribution Group
• Mail-enabled Group
• Security Group

Note, however, that Office 365 groups are not supported and cannot be added to any roles.

This is the relevant document, hope to help you:

https://docs.microsoft.com/power-bi/admin/service-admin-rls#working-with-members 

Best Regards,

Community Support Team _Charlotte

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[otravers]

@v-zhangti your answer doesn't really address the question. A security group is a Group Type within AAD, while a Dynamic User is a Membership Type (see screenshot below). Nothing in the RLS documentation mentions a restriction in terms of Membership Type, so AAD Security Groups with Dynamic Users should work for RLS. Please advise.

[otravers]

Follow up: I tested Dynamic security groups in AAD, they get recognized and properly work for Power BI RLS.

[naninamu]

Hi @otravers 

Im new to all this, but need to do what you've done. Can you please briefly outline how you achieved this? I can't work out how to being in the AAD groups to PBI.

thanks, Andrew

[otravers]

@naninamu Look at the RLS/OLS entry in my signature and search for "AAD", you'll find a brief explanation and supporting links.

[naninamu]

Great, thanks! I'll have a read 👍