Managing Access with Different Groups

[Wesleybarton]

I am member of a large organization.  I have created a report that I have published to an app that I need to share to different groups both internally and externally.  This one report will be filtered in multiple ways to create many different forms of the report. Basically it holds all data but different Brand Teams in the organization will only need to see their data.  I plan on doing this with RLS. 

My question is around how to create groups that myself and my team have the ability to go and add/delete member as needed.  These groups would then be used for granting access with the RLS and also access to the app.  I have tried to research Azure Active Directories and I am not finding the solutions.  

Do I have to be an admin of my entire company to create a group?  

Is there a way to create a group and give admin rights to my immediate team?

Am I thinking about this correctly to have groups that we would add and remove people as needed to give access and maintain RLS within a PBI app?

Does the fact that I am trying to share internally and externally create issues?

I cannot imagine my situation / need is something that isn't found in other companies.  I would really appreciate any help, tips or insights you can provide.  

[v-shex-msft · Accepted solution]

HI @Wesleybarton ,

#1, For old version workspace, you need office tenant admin right. For new workspace, it requirement power bi admin permissions.

#2, Nope, I don't think it is possible to do permissions managed in group, you can only share the group admin right to members.

#3, Current you can only edit RLS rule on desktop side, then dispatch RLS roles to users to enable RLS on service side.

#4, You can consider to use azure b2b to add external users to your organization.

Distribute Power BI content to external guest users with Azure AD B2B

BTW, when you use RLS on group, it only works on group members who has read permission. Using RLS with app workspaces in Power BI

Regards,

Xiaoxin Sheng