Dynamic RLS using Entra ID Security Groups not working in Power BI

Hii Pravanjan 

Power BI Dynamic RLS works with user identity (USERPRINCIPALNAME) and does not natively resolve Entra ID Security Group membership in DAX, so group-only tables won’t work directly. Entra groups are supported only for assigning roles in the service, not for dynamic evaluation inside the model. The recommended approach is to expand groups into user-level mappings (via ETL/API) and use that table for RLS; fully dynamic group-based RLS without this step is not currently supported.

Hi Pravanjan , Yes, this is by design. Power BI's USERPRINCIPALNAME() function returns only the signed-in user's email/UPN — it has no built-in capability to resolve Entra ID (Azure AD) Security Group memberships at query time. DAX has no Graph API access, so group membership cannot be evaluated dynamically inside RLS filters.
Entra ID Security Groups cannot be used directly in RLS role definitions for dynamic filtering. 

You can make use of the Azure Ad connector in PBI to hit your domain and extract the ad group details (This will work locally but to make it work in service you need to set up the gateway) you need to get the user -> group mapping data 

UserGroupMapping

fact table :

Relationship :

UserGroupMapping mapping to Fact (Many to Many UserGroupMapping table filters fact )

Crate a role :
Dynamie RLS and add the dax to filter 

[AccessGroup] IN
CALCULATETABLE(
VALUES(UserGroupMapping[GroupName]),
UserGroupMapping[UserEmail] = USERPRINCIPALNAME()
)

Thanks