AD groups in Power BI (Office 365) groups

[hargel]

Hi,

Sorry for a question that I probably should find an answer to without asking. But I draw blank in trying to find a conclusive answer.

We have a solution were we will use groups to separate reports and for security. In the organization AD groups are used. AD groups will also be used to control access to some of the source systems. It would therefore work best if AD groups could be used to control access to groups in Power BI.

Is this a possibillity today? If not, will it be in the future? If not, what is the "best practice" solution in this case?

Thanks,

Martin

[Seth_C_Bauer · Accepted solution]

@hargel 

Is this a possibillity today? No

If not, will it be in the future? Don't know

If not, what is the "best practice" solution in this case? My typical approach is to use Group workspaces to organize departments of Report Authors and use them as the central point to share reports with end users. In this manner, you can share a dashboard with an AD group with no issues, and the reports are all managed in one location.

As opposed to creating a seperate Group Workspace for a set of individuals. This also includes the problem that now the end user has to hunt around several Group Workspaces to try to find reports if they belong to several Groups. Whereas with the first approach and good naming standards, everything is in their workspace to be viewed.

[Amie]

When I tested sharing to an AAD Security Group I ran into some issues in revoking access. Members who were removed from the AAD Security Group retained access to the shared content in Power BI Service (as well as the report embedded in SharePoint Online). Also, when we revoked access to the entire AAD Security Group inside of Power BI, the individual members of the AAD Security Group still retained access.

Has anyone else had this issue, or is anyone aware of a resolution? 

[Seth_C_Bauer]

@Amie This is definitely disconcerting if that is the case. I assume the sharing was done via dashboards and that only the AAD group was shared too, and the individual users were not also shared to as well...

And for the second case, you stopped sharing with the group and the entire group could still see the dashboard? How soon after the removal did you check, and if it was awhile later, was it still the case? Just making sure it wasn't a timing issue, in that it would take a bit to remove the permissions across the environment.

Also - I would suggest if this is actually the case, that you create a seperate post since this one was already closed. 

[Seth_C_Bauer · Accepted solution]

@hargel 

Is this a possibillity today? No

If not, will it be in the future? Don't know

If not, what is the "best practice" solution in this case? My typical approach is to use Group workspaces to organize departments of Report Authors and use them as the central point to share reports with end users. In this manner, you can share a dashboard with an AD group with no issues, and the reports are all managed in one location.

As opposed to creating a seperate Group Workspace for a set of individuals. This also includes the problem that now the end user has to hunt around several Group Workspaces to try to find reports if they belong to several Groups. Whereas with the first approach and good naming standards, everything is in their workspace to be viewed.

[hargel]

Thanks @Seth_C_Bauer!

Interesting solution you propose. Will definately follow up on that.

A question on what you said. Is it so that I can share a dashboard (and the underlying reports and datasets) with an AD group and the AD group in a way that if I later add a user to the AD group that user automatically has access to the dashboard?

[v-micsh-msft]

Hi hargel,

 I would add some additional information here.

When saying AD group, I think you means security group in AD. There are three types of groups defined in O365, Office 365 group, Security Group and Contact group (known as distribution list, used to send emails). Groups in Power BI refer to Office 365 group, which is different from the other two. Office 365 group owns a special tenant(used for online services) which is used to store the related items used for sharing and the other stuffs.

For Security group in Active Directory, the related information is stored in Active Directory(synced to O365), which currently is not supported for Power BI.

To manage groups(configure) in Power BI, we need to access O365 Admin center.

Regarding Power BI management under organization, please check:

Administering Power BI in your organization

Power BI admin portal

About the Office 365 admin center

If any further assistance needed, please post back.

Regards

[hargel]

Hi @v-micsh-msft,

You're correct, that is what I meant. But as I understand it now, groups in Power Bi doesn't support security groups in AD. However, you can share a dashboard with a security group in AD. That is the reason behind @Seth_C_Bauer's solution. 

Please correct me if I'm wrong. We will ha lots of users and are looking for the best solution both in terms of handling security and user experience.

BR

Martin

[v-micsh-msft]

Hi hargel,

If we have synced the AD security group, we might see it under Office 365 admin portal, however can't manage the group in Office 365.

To share dashboard with the email address of a distribution group is available, but it requires we use Office 365 for email, and the distribution group is defined under Office 365. Check:Share a dashboard with colleagues and others

Although sharing with the AD group would show no errors under Power BI, group members will not receive any email remindings of a shared dashboard. Only sharing to the personal email address will the reminding email be successfully sent.

Regards

[hargel]

Thanks,

I will test everyting out soon. We do have Office 365 for mail and can use groups there with workspaces in Power BI.

However, we do control access using AD security groups, both source system and cube access, therefore it would be convinient to use that in Power BI. 

I'm not 100 % sure what you mean with "show no errors", if it will work or not, but I will try it out to see how everything works in our setup.

[IshaqMd]

Hi, 

@hargel were you able to test out everything. Can you please share your findings. 

Thanks

[IshaqMd]

Hi, 

@hargel were you able to test everything.  Can you please share your findings. 

Thanks

[Seth_C_Bauer · Accepted solution]

@hargel Yes. I don't want to be in the business of User management in Power BI.

If I want to share a dashboard to 100 users, let the access be dictated by IT and AD.