Need to create RLS for Existing Active directories groups

[Raam28]

Hello,

 I am aware that we should have Desktop Pro inorder to implemet Role level security(RLS) but i need some clarity on the below queries:

1. Our client told they need RLS to their reports but here they told they dont want to add users or else create groups for the role management instead of that they already had security groups or some other group hiearchy in their Active directories (AD) we need to use those groups only to give RLS  is it possible?

2.And the second idea is to embed that report to their sharepoint (On prem), so If i develop reports with all RLS is it reflect while we embed the report link in to their share point? or how to acheive this ? 

3. I need to know how to add the existing Active directories (AD) groups inorder to create RLS feature please let me know how can we get already created AD groups in POWER BI PRO or service to assign the roles..

Thanks in advance

[dilkushpatel]

If your dataset has some user table which has all this users in there then you can lookup for embedding with filters and then it will be matter of finding logged in user which should be possible in sharepoint i guess and then pass that user name as filter to report.

Also I think it is possible to apply RLS with groups

https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-rls/

Check Working with members section

"You can add a member to the role by typing in the email address, or name, of the user, security group or distribution list you want to add. This member has to be within your organization. You cannot add Groups created within Power BI."

[Raam28]

Hello first i will thank u for ur reply @dilkushpatel

In my case I want dynamic groups i.e i dont want to maintain a data sources of the users as like another table and create a relationship with main data source inorder to works as a filter.. becuase if any new user comes/ old user has to be remove we need to be do it manually...

So We already had dymaic AD groups with lots of users i just wanted use them in my Report for RLS .. is there way to do that..

Please suggest regarding this..

[dilkushpatel]

You will be able to add your groups to RLS settings but how will power BI know what data to show for this user?

Usually how it works is we have one user table which will get filtered by logged in users id and then rest of the tables will get filtered due to relationship and a result you see needed data.

You can always import data from your active directory into SQL and ultimately into Power BI (unless there is a direct way which I do not know).

[Raam28]

@dilkushpatel thank you .. Now i am geeting some ideas

Can you please give the steps to import the users and groups of AD to power BI and how we can make relationship with our charts?

[osinquinvdm]

importing is OK for the short term but I'd be interested in ways to make that link dynamic.

Today I have a table in Power BI with all my users and the groups they belong to.

Using the username() function I can get their username, then relate it to their group(s) and filter the data accordingly.

but maintaining that user+group table is tedious and error prone so it would make more sense to rely on AD.

and it only makes sense if we can do it dynamically, with a function that would return the list of groups/roles in AD the current user is associated with.

[osinquinvdm]

I actually found how to achieve this and documented it in https://community.powerbi.com/t5/Desktop/How-to-leverage-Active-Directory-to-filter-the-data-in-Powe...