Thanks, just thought tossing out how I have done this in the past might show a bit more of what might be a bigger picture.

We leveraged both Group in AD mapped to SSAS, and sometimes down to the individual.

What helped was Domain Admins that would create the requested groups quickly, and they delegated the membership to us.

I also developed some queries directly against AD for Group membership. Very handy to quickly see this in Excel from time to time, especially for audits.

Also was good for a quick check, as many times we had functional roles match up with job responsibilities.

Fishing - work hard, but take the time to play hard too.