Security Groups in Tenant Settings without AAD

[Anonymous]

We don't use Azure because we have a different set up for email (Lotus Notes) and haven't yet identified a need to pay for this service (our use of Office 365 products is run completely independently). Is there a way we can restrict the Tenant Settings to certain Office 365 Groups / Power BI Group Workspaces without the use of Azure?

At the moment, when I type anything into the Apply to -> Specific security groups -> Enter security groups field, nothing displays.

When I go into the Azure Portal -> Azure Active Directory -> All Groups; the groups we've created via the Power BI Service and Office 365 Admin Portal display here, so why wouldn't they be showing as selectable in the Tenant Settings?

[Anonymous · Accepted solution]

For anyone having this problem; the Group Type as seen in the Office 365 Admin Portal and Azure Portal needs to be "Security". This is achieved by creating the group in the Office 365 Admin Portal. Groups with a Group Type of "Office" (or "Office 365 Group") can't be used in Tenant Settings - this Group Type is applied when groups are created in Power BI as a Group Workspace.

[GilbertQ]

Hi @Anonymous

I only use Azure Active Directory and when I go into the Tenant Settings, I am able to see my Azure Active Directory Groups that I created in the Azure Portal, or from the Office 365 Admin, so I am unsure why you cannot see the groups.

Could you possibly try and create a group using Active Directory Group in the Azure portal? (https://portal.azure.com)

[Anonymous]

Hi @GilbertQ

I'm hesitant to do anything in Azure as we don't have an Azure subscription and I get the sense we'll be charged something if we start using chargeable tools within the portal (it's not super clear what's part of the free subscription). Looking at the setup, it looks like our Power BI Group Workspaces are set up with the same attributes as would be applied if the group was created in Azure (I opened the Add a Group dialog and the existing ones have the same settings applied).

It might be best if I raise a support ticket with Microsoft for this one?

Thanks,

Olivia

[GilbertQ]

Hi @Anonymous

I can confirm from my personal side that I do not pay anything to use the Azure Active Directory that is setup as part of Power BI. I have used it to create new users and groups without any issues. (I do not have any credit card details stored in Azure)

So you should be able to create the Azure Active Directory Groups as required. 

What happens is when you create an App Workspace in the Power BI Service it actually creates the Group, as well as adds those specific users into the Group also for you. So in my personal opinion it is automating the steps for you, which you would do manually yourself?

[Anonymous]

Hi @GilbertQ

We aren't using apps yet as they don't feature the functionality we want - we're still using content packs; so I create app workspaces in the Power BI Service for this purpose.

I tried adding a group in Azure, this didn't make any difference in Tenant Settings. When I added a group directly through Office 365 Admin Portal, the Group Type applied is Security (as opposed to Azure Portal and Power BI Service assigns the Group Type; Office). This made the group appear in the Tenant Settings fields.

Would you happen to know what causes the Azure Portal and Power BI Service to apply Office as the Group Type upon creation? There isn't a field to populate called Group Type.

[GilbertQ]

Hi @Anonymous

It does appear that for the Groups to be shown in the Tenant settings that they have to be of the Type "Security"

Whilst for Groups with the Type "Office" can be used in Apps.

I did a quick test and I could add both Group Types of "Office" and "Security" to Content Packs.

But when I was in an App Workspace I could only add individual members and not any groups.

So it would be safe to say that if you wanted to have people in groups for Tenant settings, then the group type would need to be "Security", which in my mind makes sense because it is for security related permissions.

[Anonymous]

OK thanks for the clarification. The problem I have is all of our existing groups were created in the Power BI Service (so they all have a Group Type of Office). My understanding is that the only way to change the Group Type on the existing groups would be to edit them in the Office 365 Admin Portal. However when I try to do this, I see the following message:

Is there any other way to change our existing groups to Security without recreating all of them in the Office 365 Admin Portal?

[GilbertQ]

Hi @Anonymous

This is a little outside my knowledge and I am going to assume that because the existing Group Creation in the backend is reliant on an Exchange License, there is no other way to do this without that license. I do hope that I am wrong and that someone else on this thread will give you another way to complete this.