Forum Discussion
Advocate ISetting of Membership in Semantic Models using notebook
To pass an Azure AD security group correctly as a role member in your semantic model, you typically need to provide more structured information than just the group’s ObjectID. Many SDKs, including the one you're using (sem-py-labs), are designed to accept simple string inputs like user email addresses, which work fine for individual users but fail for security groups because the system cannot determine the principal type. To add a group, the expected format is often a structured object that explicitly defines both the member’s identity and type. For example, some APIs and tools require the group to be identified using a prefix like aad://<group-object-id> and specify the memberType as "Group". This helps the service recognize that the ObjectID belongs to a group and not a user. However, if your current SDK doesn’t support structured inputs, you may need to switch to a tool that supports the Tabular Object Model (TOM) or XMLA scripting, such as Tabular Editor, PowerShell, or direct XMLA requests. These methods allow more control and let you add role members with detailed metadata, ensuring that Azure AD groups are properly recognized and accepted.
Super UserHi BalfourBen
The error you’re encountering when trying to add an Azure AD security group by its ObjectID to a role in your semantic model typically happens because the API or library you’re using doesn’t recognize the group identifier in the way it expects. While adding individual users using their email or user principal name works smoothly, security groups often require a more specific format or additional metadata—such as specifying the principal type as “Group”—to be correctly processed. The tool or SDK you’re using might be interpreting the ObjectID as an invalid user identifier, resulting in the failure. Additionally, only certain types of groups, like Azure AD security groups (not Microsoft 365 groups or distribution lists), can be added as role members. To fix this, you usually need to pass the group information as a structured object that clearly indicates it is a group, or use the Power BI REST API, which supports specifying groups explicitly when assigning roles. Without this, the server rejects the membership as invalid, causing the error you see.
Advocate IPoojara_D12 thank you for your reply.
Please could you be a little more specific on how I pass the group information as a structured object as currently not seeing anything in the documentation to demonstrate this.
- Poojara_D12
To pass an Azure AD security group correctly as a role member in your semantic model, you typically need to provide more structured information than just the group’s ObjectID. Many SDKs, including the one you're using (sem-py-labs), are designed to accept simple string inputs like user email addresses, which work fine for individual users but fail for security groups because the system cannot determine the principal type. To add a group, the expected format is often a structured object that explicitly defines both the member’s identity and type. For example, some APIs and tools require the group to be identified using a prefix like aad://<group-object-id> and specify the memberType as "Group". This helps the service recognize that the ObjectID belongs to a group and not a user. However, if your current SDK doesn’t support structured inputs, you may need to switch to a tool that supports the Tabular Object Model (TOM) or XMLA scripting, such as Tabular Editor, PowerShell, or direct XMLA requests. These methods allow more control and let you add role members with detailed metadata, ensuring that Azure AD groups are properly recognized and accepted.
- BalfourBen
Poojara_D12 Thanks for that.
After some searching I have found that they are adding the ability to add security groups and define the princiapal type in the next release.
Thank you for your help!