How can I add Azure Active Directory group to role in SSDT tabular project?

Question

I have SSDT Tabular Project which needs to be deployed to Azure Analysis Services.

I created new role in tabular model explorer, but when I'm trying to add my group created in Azure Active Directory as a member of this role I'm getting errors at deploy time.

If I try to add this group using Add and finding it in my organization AD, I'm getting this error:

Cannot deploy metadata. Reason: Failed to save modifications to the server. Error returned: 'The identity 'myorganization\mygroup' has invalid identity provider ''. Only Azure Active Directory users or groups are supported. Use 'AzureAD' as the value of the identity provider.

If I use Add External (I've tried several spellings - mygroup, [email protected] , [email protected], mygroupid), I'm getting this:

Failed to save modifications to the server. Error returned: 'The identity 'mygroup' was not found in Azure Active Directory. Details: Unable to resolve user or group 'mygroup'

Technical Details: RootActivityId: 4c2db4b3-9046-4ccb-bbcc-c99066a3665d Date (UTC): 9/13/2017 11:14:12 PM '.

I can deploy project without any roles and I can add my personal account ([email protected]) just fine.

I'm using VS Professional 2015 Version 14.0.25431.01 (Update 3) and SSDT 14.0.61707.300.

What's the proper way to use AAD group as role member?

Answer 1

The correct way to add group was to use Add External and provide id in following format:

obj:<group-id>@<directory-id>

I've got this from adding my group via SSMS and then using 'Script View' to see what is actually added.

Directory Id can be found in Azure Portal, in Azure Active Directory service in Properties tab.