Using the same AD Groups for both RLS and app Audiences. Is this ok or should I avoid?

[j_hoyt]

I'm in an org where I don't directly manage who's in an AD group. I need to request changes with IT, so managing and overseeing AD groups can be kind of tedious and difficult. We're wondering if we can simplify things by using our ~15 AD Groups used for Row Level Security and just use all of them as the app audience. 

I feel like because app access and RLS are different concepts we should use different groups for them, but this means managaing 2 AD groups per person. 

Are there any issues or consequences we should expect if we recycle the RLS AD groups for the App Audiences?

Thanks.

[j_hoyt]

Right, I get that RLS/Roles and Audiences are separate concepts. But both are managed through AD Groups. Is there any issue with using one AD group for both Roles and Audiences?

[aj1973 · Accepted solution]

@j_hoyt 

It's always better to separate concepts, for better data governance. But go ahead if you see it otherwise 

[Brunner_BI]

Of course you can use one AD group for an audience or assign it to an RLS role, no problem!

[j_hoyt]

Just to clarify, I'm talking about using one AD group for an audience *AND* (not OR) using it for an RLS Role. Any problem there?

[aj1973]

Hi @j_hoyt 

Your description to the issue is not quite clear ! what do you mean by recycle the RLS AD groups...?

Let's say you have a report backed by a dataset where you applied your RLS, when you publish a report into an App Audience and you add the AD Group to that audience, What happens then and what do you want to achieve?

Remember the RLS is applied to the symantic model and not to the pages of the report or audiences.