Forum Discussion

Vegard1985's avatar
Vegard1985
Helper I
5 years ago
Solved

Dynamic RLS with AD Security Groups - best practices and app sharing?

Hi.   I just wanted to post some of my own experiences on DRLS, and want to reach out to get some tips/ideas/best practices on how DRLS should work in practice, and how this should be distributed. ...
Need Help
Show and Tell
Tips and Tricks
  • v-janeyg-msft's avatar
    v-janeyg-msft
    5 years ago

    Hi, Vegard1985 

     

    It’s my pleasure to answer for you.

    According to your description, I think you have great ideas. If your reports needs to be distributed to users with different permissions to see different data, RLS can indeed be used, and it is inevitable.

    In the recent update, it has been supported to connect powerbi dataset and other data sources at the same time.

    LInk:Power BI December 2020 Feature Summary | Microsoft Power BI Blog | Microsoft Power BI

    After setting up RLS, you can publish an app, add the "all employees" group you mentioned, and then they will see different content according to the permissions you set, and other users outside of RLS can access the report, but they can't see all the data.

    Remember not to give the user  build permission of the dataset or edit permission of the report, otherwise RLS won't work.

    If it doesn’t solve your problem, please feel free to ask me.

     

    Best Regards

    Janey Guo

     

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

DCEQAO's avatar
DCEQAO
New Member
5 years ago

Sorry for my ignorance - newbie here...

 

Another kick at this topic re: best practises:    In my solution, I am proposing to use a security group based access control to secure sensitive data, much as the orignal poster has outlined, but with one significant difference - I wish to dynamically evaluate a user's membership in groups using a GraphAPI "https://graph.microsoft.com/v1.0/users/{user}/memberOf" instead of a table containing the users as original poster suggests.    The output from a join of the memberOf to the Groups table should yield the appropriate permissions.

 

Does any one have a method to include the GraphAPI data as a "table"  joined against a table in a tabular model using a live connection?  I could also change to a solution utilizing direct query if necessary, instead of a live connection.    

 

Is there some other way to surface the user's group membership in M or DAX that I have missed?

 

Comments and guidance would be most appreciated - I can't be the only one wanting to secure DRLS with security groups!

 

Thanks to all in advance!