Suggest an Idea

[ift_isabelle]

At the moment you have to give a person access to a space in Qlik Sense Saas.
But for large environments, with lots of users this is really time consuming to maintain.
I would like to give permission to use a space with the use of an AD-Group.

So example User A is part of the Finance department, the user can see the space Finance.
User B is Finance Business Analist and this user can see and create apps in the space Finance.
But User C who is part of the HR team cannot see or do anything in Finance.
They all have specific AD-Group assigned (e.g. in Azure) and I want to assign the access based on the groups instead of the person.

[AlexOmetis]

You can do this already if you set up your IdP to bring in groups and have QS SaaS recognise them.

However it's worth noting there are limitations to this -

1. Groups won't be seen by QS SaaS until someone in the group logs in.

2. Membership of a group will be evaluated at each login - no group membership is stored outside of the individual user session.

3. Users given access via a group won't be able to be added to Notes and some other features.

[ift_isabelle]

@AlexOmetis That limitation is do-able. Is there documentation on how to bring the groups to SaaS? And I only have the option to add members to a space, where can I select these groups?

[AlexOmetis]

If you're using Azure AD, the best guide is How To: Configure Qlik Sense Enterprise SaaS to us... - Qlik Community - 1704442

The only thing it doesn't cover I think is that in QS Management Console you need to go to Settings and enable group creation. 

[ift_isabelle]

@AlexOmetis Thank you very much! It looks like this is working!

[jheasley]

Sidenote and HUGE gap to this - Notes are not aware of users in groups.  so if a space is permissioned to a group, the users won't be taggable in notes until they are explicitly added to the space. 

[AlexOmetis]

@jheasley - yep, absolutely right. As I understand it, this is mostly because QS SaaS doesn't have a mechanism to track what groups a user is in except during an active session. Since it doesn't know who is in a group, it can't see if they should be able to be referenced in a Note or other things.

I see you've spotted the thread I commented on relating to this: Notes mentions working with AD-groups - Qlik Community - 1838950. Apparently something is "on the roadmap" relating to this - what that is, we'll have to wait and see!

[Meghann_MacDonald]

From now on, please track this idea from the Ideation portal. 

Link to new idea

Meghann

NOTE: Upon clicking this link 2 tabs may open - please feel free to close the one with a login page. If you only see 1 tab with the login page, please try clicking this link first: Authenticate me! then try the link above again. Ensure pop-up blocker is off.