Unable to update app until users are removed: 'groups have failed validation'

[TM_Visual]

This is an on-going minor problem that has affected my team for a long while, and I thought I should finally get round to finding a proper olution. I can add a new user to an app audience (or prior to that, the access list) and update the app.

However if I change the user list and one of the existing users in that audience has left the organisation, the app will not update.  This is likely to be because their account is deactivated. The error message is:

The following groups have failed validation : "12345678@company.com"; "12345378@company.com"; "56345678@company.com"; "12341178@company.com"; "12340088@company.com"

The error has to be closed, then the users manually removed from the audience by finding their name in the list.

This is awkward, especially when an app has a large distribution list to scroll through, or a large number of staff members have left since the last update.

I believe that the issue is likely due to the identity system used by my org.

All users have an underlying identity in the format 12345678@company.com. We also have an email identity as name.firstname@company.com . The error message shows the ID number@ email address of staff, but the audience lists their name.surname@ email address . Because the ID numbers are not known, we have to use another system to look up the ID number of each person!

However their names are obviously being linked up somewhere, as the error message ID number@ email addresses are listed in  the alphabetical order of the name.surname of the users!

Perhaps Microsoft's identity management system is viewing each of our users as their own 'group'. 

Is this a widespread problem, is there a better solution, or can it be made possible to update an app even if groups fail validation?

[TM_Visual · Accepted solution]

I have raised this in the ideas forum, and after a suggestion there, as a support ticket. The outcome after speaking to support is basically "tough luck, that's how it works". An idea has been opened to broadly change how access is removed from larger numbers of users, but it is rather general.

So although the Power BI access system is built around individuals requesting access and being granted on a per-person basis, the best solution is to reject all individual requests and only use groups set up using another part of Office 365. 😞

If anyone else is having this issue, the only solution I can recommend is using groups and otherwise putting up with the inconvenience.

[foodd]

Hello @TM_Visual , thank you for sharing your issue with the Community Forum. In addition to this post, you may consider opening a new issue, which will provide an additional level of interest from the support team. This also has the benefit of allowing other members of the forum to provide feedback in the form of a comment and show their support by upvoting the issue. An issue may be submitted as follows:

Issues

If you have found a true bug or issue, you can make a post to the forum to let others know (and that would be very nice of you to do so). But if you want to get it fixed, you should post it in the Issues/Ideas (it varies) area of the community. Specifically, you should post it here:

Power BI - https://community.powerbi.com/t5/Issues/idb-p/Issues
PowerAutomate - https://powerusers.microsoft.com/t5/I-Found-A-Bug/bd-p/BugFound
PowerApps - https://ideas.powerapps.com


Ideas

If you have a new idea for functionality or how something should work, you can certainly start a thread on the community to solicit feedback on your idea, but you should also post the idea in the ideas section of the website and solicit others to vote on your idea. The development teams use the Ideas area of the communities to build their development pipeline and a significant amount of weight is placed on Ideas that have lots of votes versus those that do not. The ideas areas of the communities are here:

Power BI - https://ideas.powerbi.com
PowerAutomate - https://powerusers.microsoft.com/t5/Flow-Ideas/idb-p/FlowIdeas
PowerApps - https://powerusers.microsoft.com/t5/PowerApps-Ideas/idb-p/PowerAppsIdeas

If your requirement is solved, please make THIS ANSWER a SOLUTION ✔️ and help other users find the solution quickly. Please hit the LIKE 👍 button if this comment helps you.

[Tutu_in_YYC]

I have encountered this situation. One work around is to create Security Groups for all the users, and use it in the app to assign access. This way, if a user leaves, it will dissapear from the security groups automatically, and you wont need to remove the user manually