Power BI + Live Connection Analysis Server + security

[CEnders]

Hi,

We are using Power BI + Power BI Gateway with a live connection to tabular Analysis Server on premise.

That works fine.

However those Power BI users must be autorised on the tabular datamart to use the live connection.

Is it possible to not autorise them ? Only autorise them for the dashboard and not for the underlaying datamart.

I have specified a dedicated on permise user in the gateway. The dashboard should be using that user to query the data. Same as when he is importing or refreshing data. 

I am thinking of renaming the pbix file to a zip file, unpack it, edit the connection file and add some properties like effective username to the string. Connection properties to Analysis Services are specified here : 

https://docs.microsoft.com/en-us/sql/analysis-services/instances/connection-string-properties-analys...

Any other ideas ?

Constantijn 

[v-juanli-msft]

Hi @CEnders 

---

@CEnders wrote:

However those Power BI users must be autorised on the tabular datamart to use the live connection.

Is it possible to not autorise them ? Only autorise them for the dashboard and not for the underlaying datamart.

I have specified a dedicated on permise user in the gateway. The dashboard should be using that user to query the data. Same as when he is importing or refreshing data. 

I'm not clear about these above.

Please refer to the following guide to configure schedule refresh for SSAS.

Manage your data source - Analysis Services

Power BI: Data Refresh ad SSAS On-Premises Connectivity

Best Regards
Maggie

Community Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[CEnders]

To make it clear.  We have a normal user called John and a Power BI Gateway User called GatewayUser.

The GatewayUser can access the ssas tabular datamart. John can't access the datamart.

User John access the dashboard and requests data. Using the gateway the data is retreived (live) from the datamart under the credentials of John.

What I want is that the data John wants, is requested under credentials of the GatewayUser.

Of course import is an option, but the live connection has much more benefits.

How can I implement impersonation on a live connection to use the gatewayuser identity ?

Can I specify the effectiveusername  ?