topic Re: Access to spaces on Azure AD group in Management & Governance

How to restrict access to spaces based on Azure AD groups in Qlik Sense SaaS (Cloud)?

ift_isabelle — Sat, 27 Aug 2022 09:06:53 GMT

We have Qlik Sense SAAS and we have an Azure AD.
We already connected the two of them and are logging in with our Microsoft account.
Now we want to give and restrict access to spaces based on Azure AD groups. Is this possible in SAAS? And if yes, how?

Kind regards,
Isabelle

Re: How to restrict access to spaces based on Azure AD groups in Qlik Sense SaaS (Cloud)?

Seanog_Murphy — Sat, 27 Aug 2022 09:01:23 GMT

Hi @ift_isabelle

Yes, this is possible as long as your tenant administrator has enabled groups, you can also add groups of users to your space. For more details see the articles here:

Re: Access to spaces on Azure AD group

ift_isabelle — Mon, 14 Mar 2022 15:43:07 GMT

But this is what a user can do and can see within a space. You still need to assign a user and userroles to the space.
I want to make a rule, if user is from the finance department, you can see the space Finance. Like what you can do with security rules on premise.
Do you know if that is possible?

Re: Access to spaces on Azure AD group

Seanog_Murphy — Tue, 15 Mar 2022 08:12:08 GMT

@ift_isabelle
I don't believe that this is possible in the current version. Perhaps you can raise a feature request if this is something you would like to see in the product. You can find the steps to do this here:
- https://community.qlik.com/t5/Knowledge/How-To-Submit-Feature-Requests-For-Qlik-Products/ta-p/1712581

Re: Access to spaces on Azure AD group

ift_isabelle — Tue, 15 Mar 2022 08:29:14 GMT

Thanks.

If anyone else is looking for this: I created an Idea, please like it!
https://community.qlik.com/t5/Suggest-an-Idea/Access-to-a-space-based-on-an-AD-Group/idi-p/1905147#M8958

Re: Access to spaces on Azure AD group

ift_isabelle — Tue, 29 Mar 2022 13:36:23 GMT

You can do this if you set up your IdP to bring in groups and have QS SaaS recognise them.
In QS Management Console you need to go to Settings and enable group creation.

However it's worth noting there are limitations to this -

1. Groups won't be seen by QS SaaS until someone in the group logs in.

2. Membership of a group will be evaluated at each login - no group membership is stored outside of the individual user session.

3. Users given access via a group won't be able to be added to Notes and some other features.

Re: How to restrict access to spaces based on Azure AD groups in Qlik Sense SaaS (Cloud)?

Rakesh_HB — Sat, 27 Aug 2022 09:06:04 GMT

If you're using Azure AD, the best guide is

How To: Configure Qlik Sense Enterprise SaaS to use Azure AD as an IdP. Now with Groups!

The only thing it doesn't cover I think is that in QS Management Console you need to go to Settings and enable group creation.

This is mostly because QS SaaS doesn't have a mechanism to track what groups a user is in except during an active session. Since it doesn't know who is in a group, it can't see if they should be able to be referenced in a Note or other things.

Currently, this is on the Roadmap!