Restrict access to ssas MD cube measures via roles

[Anonymous]

Hi!

Im wondering if there's a way of restricting access to certain measures when loading a MD cube into power BI via import data?

Let's say I have a cube with three measures. A B and C.

I want to create three different roles, X Y and Z where each role can only see one of the measures. X should only see measure A, Y should see measure B and Z should see measure C.

I can see that it's easy to create roles to filter dimension members, and also filter on values for measures, but can't find an option to actually hide certain measures completely from a role.

By connecting live to the cube this is possible of course, as measure security can be defined in ssas security roles, but I want to know which options that are available when importing the cube data to PBI. 

Is there a DAX expression available to do it maybe?

[Greg_Deckler]

You would use Row Level Security.

[Anonymous]

But how? RLS doesn't seem to serve my needs if I understand how it works correcty.

I'm guessing that what i'm after is sort of a column level filter. Where I can define that a certain role in PBI should not see any values at all in some "columns".

For example if I have a measure group in my cube with measures Sales and Profit, and want to make sure that some users can only see values for sales, and not see anything at all regarding profit.

In ssas I can define role properties for the measures dimension, where I can pick which specific measures a role has access see. In Power BI I can't find if, where and how I can do the equivalent set up. I can apply a value filter on the measure but that's not what I want.

Or am I trying to approaching this the wrong way?

[v-haibl-msft · Accepted solution]

@Anonymous

Measures in a multidimensional cube are exposed in Power BI as tables with the ∑ sign beside them in the Fields pane. It just seems like a “column” in it. As you know, we can restirct different roles to see different row values, but we cannot restrict columns in Power BI.

Best Regards,

Herbert

[Anonymous]

Hi @v-haibl-msft

I'm guessing what you meant is that measures are exposed as "columns" in the fields pane?

Anyway, I didn't know that PBI didn't allow restrictions on column level. I was really hoping that there was a way of accomplishing it and that I just hadn't found it yet 🙂

Very unfortunate that this feature is not available. It's a key feature where I'm working at the moment. Really hope they introduce it eventually. MS already has a solution for it in the current ssas role security functionality.

Thanks for clarifying this cannot be achieved though.

[v-haibl-msft]

Yes, that is what I meant.