Forum Discussion
Advocate ISetting of Membership in Semantic Models using notebook
To pass an Azure AD security group correctly as a role member in your semantic model, you typically need to provide more structured information than just the group’s ObjectID. Many SDKs, including the one you're using (sem-py-labs), are designed to accept simple string inputs like user email addresses, which work fine for individual users but fail for security groups because the system cannot determine the principal type. To add a group, the expected format is often a structured object that explicitly defines both the member’s identity and type. For example, some APIs and tools require the group to be identified using a prefix like aad://<group-object-id> and specify the memberType as "Group". This helps the service recognize that the ObjectID belongs to a group and not a user. However, if your current SDK doesn’t support structured inputs, you may need to switch to a tool that supports the Tabular Object Model (TOM) or XMLA scripting, such as Tabular Editor, PowerShell, or direct XMLA requests. These methods allow more control and let you add role members with detailed metadata, ensuring that Azure AD groups are properly recognized and accepted.
Community SupportHi BalfourBen.
Thank you for reaching out to the Microsoft fabric community forum.
While adding named users (email addresses) works, attempting to add a security group (via Object ID) throws the following error:
OperationException: 'There are invalid rolememberships in roles, please remove invalid rolememberships from roles and try again.'
This means the script is not recognizing the Object ID as a valid role member.
The error occurs because you are passing the Object ID of the Entra security group, but the semantic model requires either a user email or the display name of the group, not the Object ID. Kindly replace the Object ID with the group's actual display name (e.g., 'Finance Team'). You can locate this in Entra (Azure AD) under the "Groups" section. Once replaced, your script should function correctly.
Power BI Semantic Models only accept Entra group names or user email addresses (UPNs) as valid role members. Object IDs are not accepted directly. Although Object IDs represent users or groups in Entra, the Analysis Services engine (used by the semantic model) requires a resolvable user principal name or security group name, not its GUID (Object ID).
Supported: Distribution Groups, Microsoft 365 Groups, Security Groups as long as they are resolvable by name. Not Supported: Object IDs or Service Principals directly. Please ensure the group is mail-enabled or otherwise resolvable in Entra; otherwise, Power BI will fail to validate it.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you for using Microsoft Community Forum.
BalfourBenHi v-kpoloju-msft ,
Thank you for your reply. I have tried replacing the the ObjectID with the group name and recieve the same error.