Sharing Power BI Apps with AAD Security Groups

As you have probably seen Power BI has introduced two new sharing paradigms:

1. Apps for the consumption of the data
2. App workspaces for the editing/authoring/collaborating of the data

Had a couple of customers asking about sharing their Apps and App Workspaces using AAD Security Groups.  While i typically recommend the security best practice of sharing all resources with AAD Security Groups in this case Power BI  doesn’t support adding AAD security groups as members of App Workspaces…But in most cases you will be sharing the resulting Power BI Apps –which CAN be shared with AAD security groups….And wanted to document how this can be accomplished.

1. Create a Group in the Office Admin Portal

Note while you can create groups in Azure Active Directory admin center (https://aad.portal.azure.com) it doesn’t expose the alias meta data and populates it with not very friendly GUIDs like:

a49eb981-3437-40c0-a54f-0b818ae18781@powermvps.com

2.  Add the members to the AAD Group

Here you probably WILL want to use the Azure Active Directory admin center as the office Group dialog only displays Office Users not all the users in your active directory.

(Note: none of the users above show up in the “Add” dialog of the Office > Groups > Dialog as they are only actives directory users not licensed office members. )

3. Update the Power BI App to use the AAD Security Group

4. Add the AAD Security Group to the Access List for the Power BI App

Note you need the fully qualified AAD Security Group ID i.e.   MyGroup@mytenant.onmicrosoft.cmo

Related and frequently asked question:

I have a premium capacity and shared the App Workspace with a Free User but they are still getting prompted: with “Upgrade to Power BI Pro” what is going on?

The issue is the fact Premium enables you to share Apps NOT App Workspaces.