Create substream access without user based custom properties. Is it possible?

[pnorsworthy]

Hello.  I've been tasked with taking 3 streams and merging them into 1 stream with all of the apps from the 3 streams.  The end goal is to have visibility of apps in the stream be based on their existing AD group access.  So if they previously had access to stream 1 (of the original 3) they could then see the apps from the original stream 1 in the new "all encompassing stream."

In my current environment all access is driven by if you have this AD group you can access this stream, and see all the apps within it.

I've watched a couple great videos and read a handful of articles.

@Michael_Tarallo 

https://www.youtube.com/watch?v=yaBfW2RtxGA

@Levi_Turner 

https://www.youtube.com/watch?v=h5nBdt969XI

but I don't see a way to accomplish this without having custom properties at the user level.  Unless I'm missing something, as an admin managing 300+ users + comings and goings via custom properties at the user level sounds like a real pain.

For a bit of context the way people get access to Qlik now is request the AD group for the stream they need access to.  SSO handles the rest when they hit our hub.

Am I missing something or is there some way I can accomplish the single stream / app visibility based on AD group without using custom properties at the user level?

[Vegar]

What about keeping your custom properties on your app/streams, but replacing your user custom property with an AD group? 

Then you can re-use the suggested logics from Mike and Levi, you just need to change how the comparisons between app and user in the security rules. (Replace user custom property with a check on ad group)

[pnorsworthy]

Do you have any reference for what that might look like?  That may be part of my problem.  I'm having a hard time wrapping my head around the syntax just based on the videos.