Dynamics F/SCM Customer Experience (CRM) Dynamics GP Dynamics Business Central (NAV) Dynamics SL Power Platform Fabric Copilot

[Jim Lines]

Hello,
Does anyone have experience using AD Groups with Browser-only access in SSRS?  I’ve heard using AD Groups is not desired due to inconsistent behavior. I have hundreds of users in an AD group that needs access to SSRS reports.  When I add the AD group with Browser permissions, users seem to have access to all functions (Download, Delete, Manage, Folder Settings, and Site Settings!).  If the user is removed from the AD Group and set up individually as a browser, they only have browser functions (as desired).

I’ve been working with our GP Partner and Microsoft on this, but we’re not getting anywhere.  We’ve checked everything in security, and it all seems to point back to the AD Group not behaving as expected.  I’m not looking to troubleshoot anymore, but I would like to know if anyone has encountered this issue. Thanks!

We’ve also gone through this:  Microsoft Dynamics Community

Microsoft Dynamics Community		remove preview
Microsoft Dynamics Community We’ve gotten this question a bit lately, so figured it made sense to put it out to the public as a reference that can be found fairly easy, when you are setting up and deploying the SQL Server Reporting Services (SRS) reports for Microsoft Dynamics GP. View this on Microsoft Dynamics Community >

——————————
Jim Lines
——————————

[John Arnold]

Hi Jim,

IMHO – AD Groups are the ONLY way to go with SSRS!  That’s all I use and it works great.  I’m guessing there is a inherited permission from an upper folder that’s messing things up.  Give me a yell and I can help you figure it out.

——————————
John Arnold
Senior Software Engineer
US Digital
Vancouver WA
——————————
——————————————-

[Jonathan Cox]

I only use AD groups for a reporting environment. ?When I have had this occur the reason behind it was that we had IE being launched as administrator. What I didn’t think about is the built-in ADMIN roles on the reporting server, and thus the users had just wide open access. I went through and removed that, and then tested with several of our AD users and the problem was resolved and they only had browser permissions.

——————————
Jonathan Cox
Frontier Tubular Solutions, LLC
Oklahoma City OK
——————————
——————————————-

[David Morinello]

I was asked to do AD Groups at one place. However, because of the number of GP companies and Segregation of Duties concerns it would have required too many AD Groups. 28 company “RPT_” Roles * 35 plus GP Companies. 

If you are not concerned about SOD, I suppose AD Groups make management easier. I ended up with fewer to manage with the individual AD Users.
Your milage may vary.

Note: this is for the data access. Not the browser.
DYNAMICS database roles                      COMPANY database roles

pt_all user	rpt_all user
rpt_executive	rpt_executive
rpt_human resource administrator	rpt_human resource administrator
rpt_payroll	rpt_payroll
rpt_power user	rpt_accounting manager
	rpt_accounts payable coordinator
	rpt_accounts receivable coordinator
	rpt_bookkeeper
	rpt_certified accountant
	rpt_collections manager
	rpt_customer service rep
	rpt_dispatcher
	rpt_executive
	rpt_human resource administrator
	rpt_materials manager
	rpt_operations manager
	rpt_order processor
	rpt_payroll
	rpt_power user
	rpt_production manager
	rpt_production planner
	rpt_project manager
	rpt_purchasing agent
	rpt_purchasing manager
	rpt_sales manager
	rpt_shipping and receiving
	rpt_shop supervisor
	rpt_warehouse manager

Set Up Security for Your Dynamics GP SSRS Reports – FMT (fmtconsultants.com)

——————————
David Morinello
Senior Developer
TruckPro LLC
Cordova TN
——————————
——————————————-

[Jim Lines]

Hello!
Sorry, I never followed up with my solution. After days and hours of working directly with Microsoft, we discovered the problem.  We have an AD group for our GP Users, which has browser permission to SSRS.  I found that the GP Users AD group was dropped into an “external consultant” AD group that gave them elevated privileges.  After removing the GP Users group, all permissions went back to “normal”. That was it!   In hindsight, that should have been the first thing we checked.  

Thanks for everyone’s input on this! 
Jim

——————————
Jim Lines
——————————
——————————————-