Just in time when I need to add the groups in RLS. Thank you Patrick

Hi Patrick, I was using groups for RLS I believe back in 2018, but I had done that by creating groups within Outlook on Office 365. This worked great for my use as the primary Power BI admin, but I later ran into a snag. When I tried to experiment with other permissions within the Power BI Admin Portal, those groups do not appear there, I believe because the description mentions about Security Groups and I figured that was something outside of my permissions and needed done by the full blown Office 365 admin. Those RLS groups you showed in the example, are those what would be considered Security Groups that could also be used in the Admin Portal to restrict other settings?

Hi Patrick, really liked this video! Still I don't feel like it's actually dynamic. I still have to manually add all the users in a list to check their email address against their UPN. Can I somehow enter the groups here? So that instead of filtering on email = UPN I could say department = group? That way I only would have to change the source when departments change. I'm working with AS and know something like this is possible, I just don't seem to do it correctly. Thanks in advance for your help!

Hi Patrick, Your videos are very informative and useful. Could you make a video on Dynamic Page level RLS? There is no such direct feature available now.

Hey Patrick, is something like this available for the on prem (repot server) version of the product?

Hi Patrick, does RLS works for Azure AD security groups as well? It works for AD but not sure about AAD. Thanks

Hi Patrick, your videos are always my go to on PowerBI. Thank you for how you present them. I tried the implementing RLS using a mail enabled security group but it is not working. Could you think of something I am missing? Thanks.

A day late to find out but never too late! Thanks Patrick!

Hey, when you create rls at desktop level is there any dax which will help us to compare similarly to the user principal name.. our custome doesn't want to maintain the security table at power bi level.. just get the logged in user group compare with a specific group name and apply the security..

Hey Patrick, I have departments and users associated with them and I assigned dynamic RLS using USERPRINCIPALNAME. Even if I share the report with all of my organization (ALL GROUPS), only the users with those departments matching would be able to see the report. Is that correct? If yes, then I think this approach should be better than defining Active Directories, as the directories would be then a lot and maintenace would be difficult. Do give your thoughts on this. Thanks.

Hey Patrick,i am having Pro license am not able to see distribution list created in O365 does this feature you showed is only available in Premium ??

How do you deal with users in multiple roles with different else and ols? I have an Enterprise days set and was hoping to have business units manage their groups but due to additive rls, users are getting errors accessing. Also have set up roles on each fact table. Currently trying to set rls type filters on the measures to work around. What do you think? Btw, thank you for many great and useful guidances!

I'm currently working on setting up our PBI Service environment. We have a local active directory (that I can access using a dataflow, to bring in the roles and such). It for now doesn't look likely we'll switch to Azure any time soon and as far as I know there aren't any distribution lists configured. I would love for there to be a way to configure visibility, membership and RLS based on an 'external' user feed. Can you guys give me any pointer on the most efficient way to handle this? If all else fails I will have middle men keep track of their team members in the list wherever possible and do the rest ourselves. Love the video btw!

I'm still waiting for the Default Role for enabling dynamic RLS to any user coming into the report. It would be perfect and elegant

Thank you patrick...

Hi Patrick, how can we implement dynamic RLS where we need user belong to a particular region and a particular market see that specific region-market reports? Can you help me in this regard?

Hi. I've got RLS working with Active Directory groups. I've got an on-prem gateway with 2 dataflows and an Azure SQL Server connection. We're still in the implementation phase so doing multiple app pubs. Plus, we're doing version control through Teams. I'm expecting to have many more Active Directory groups in the future. Is there any way to automate adding the security groups to the dataset, or at least load them from a file? I'd appreciate any ideas.

Hello, is this available for the Report Server version ?

What is the right field value one needs to be able to add Azure Active Directory groups? In my organization there are hundreds of groups (including non-Office 365) but only a handful pop up when you type them in the 'Share' section

Hi Patrick, my distribution group contains usernames of members so in desktop I defined roles using username(). It works perfectly fine in PBI desktop but in Service when I try to test role it gives blank. Can you please help me on this?

Hi Patrick where to create security groups inside power bi or any other place to create groups

Hi Patrick! I am using a shared dataset to 2 different reports. Can I apply row level security just to one of them? Thanks!

Hi Patrick, Good stuff...

Off topic, but can you have a tooltip per entry to a table/matrix?

Hi! I have an issue that is some how related to this issue. I hope you can help me out. I need to establish a row level security involving 400 groups with around 5 users each. My RLS should be based on their groupings as the users logs in. My question is, do I have to make 400 rls roles to make this happen? Do you have any other suggestions how to do this? (users are mostly external)

Hi, there were 3 types of 'groups which works. Distribution List, Mail-enabled security and the 3rd 'Security'. Can anyone explain what is the 'security' type here.

Hi Patrick, can we use security group to give access or to provide RLS on Power BI Server as well?

awesome. Thank you.

Is this RLS security group is enough for user to see the report or you still have to share the report and give READ permission to view it?

Hello Guys, I currently have a challenge with security. I have someone who belongs to two security group within my data model and the person cannot access the data model with the message that there is a conflict. In your experience, is there a way around this? To be clear, I have multiple roles e.g. Seller, Auditor. Employee A belongs to both groups. What can I do to work around this, yet maintain security? Thanks

Great content!

Is there a way to set up roles in desktop using PBi Groups and not emails?

Can we add dynamic distribution group to the RLS?

Hi Patrick, How do we use group id rather email id on username ? We have different groups for security which has 1000+email id with combinations. We can add group in online service but want to add group id for RLS in desktop . Will be helpful if you can share some info on this plz . Appreciate it,thanks

Hi 👋 I need to create role level security for 10 diff category, with multiple email address for each respective category. I'm not supposed to create group email address for those multiple email address. Suggest me some ideas to create...

Thanks Patrick , but when is PBI going to support RLS per tab granularity? That will help a lot to create a single report for say managers and individual contributors , setting up RLS at tab level will only show pertinent information to the targeted audience instead of having to create and update (whenever I have to create new formulas or anything else) two reports instead of one. Thanks for listening 👂

Wish all the APIs allowed for the Role to be passed in the opening of the report. Can’t seem to pass a role name/code when “User Owns Data” Makes it very inflexible

You still need to manually manage emails in the dataset. We need to filter by groups directly, not people.

Hey, What settings do we need to do, when we make a Workspace/App of that report and publish it. Do we just need to add those groups/ individual people in the App/Workspace as well?

Can you do this for tiered access? E.g., A managers group, a VPs group, and a members group? What if I don't have 365 admin rights to create groups?

Hi Patrick, does it work for ‘teams’ groups?

What could be the issue if you add a SG to RLS and just a small number of people in the SG can't see the dashboard but others can? The Report is shared with the SG. The only way to fix this weird problem is to share the report with these users directly. Why is this happening to some??

Hey, I have always wondered why you cannot apply RLS to the whole company, like some "apply to everybody" check-box, which should be helpful when using dynamic RLS (ie. user permissions are part of the model). This is not risky as it will not override user access to the dataset, which is manage elsewhere, is it... ?

I cannot get this to work in Teams. Either I get no access to the team, or I get full access to the data. RLS works in PBI Desktop, but not after publishing. Anyone have this figured out in TEAMs? I should add that it works perfectly with individual users but NOT with groups (email enabled sec grp is what i tried) And what's worse, is that if you have access to the channel and the report, but i forget to add the user to the RLS security config, they get ALL data. Please tell me I'm screwing something up!? If not, this is a mess.

Does that user needs workspace permission also?

How come are M365 groups not supported?

Hi Patrick, how can I use RLS with user and password access from outside the organization (users without a license and published the report via the web)?

How can we apply RLS to control which employees having access to specific pages?

What happens to others, not in any of those groups. Can they see the report? If yes do I have to do anything to make them see the report?

Fuck, why the heck office 365 groups are not supported here, I can't understand those decisions that Microsoft takes. For example, in gateway security you can user o365 groups and not security groups. Inconsistent and inexplicable.

Gueax Tigers!!!

Is this possible in RLS AdMIN-He can access all dashboard DIVISION HEAD-he can access all data in his decision MEMBER-He can access only his data.

it doesn't work anymore, they move the RLS setting to power BI desktop

missing the Default Role a.k.a Reader Role is a blasphemy

they should not call this dynamic security to be honest