make report individual for each user that uses the report

[truttafisker]

hi there 

I have a report which I want to share with alot of people (aprox 1000 users).

I use the analysis service to get my data.

.. But I'm not sure how to approach this .. the users should only be allowed to see data that is relevant for their organization.
The users are not added to my AD so I thought of managing their access to the report, by letting them contact me, I add them "somewhere" and somehow restrict their access to the dataset from the analysis service to what's only relevant to them.

.. but I don't know what the most correct way would be .. 

It seems that I can't use the "Manage roles" feature in Power BI desktop, because I'm using the analysis service.

so would the what would the correct approac to this be ?

I'm pretty sure that I'm not the first with this issue, but I can't figure out if RLS, Service Principals or something else would be the best way to do this .. 

[maruthisp]

Hi,

Since the you are using SSAS, need to define RLS in Analysis Services cube/Tabular Model.
In SSAS, Create roles with DAX - [OrganizationID] = USERNAE()
Or

Other option is use EffectiveUserName with Power BI Embedded as you are not in Azure AD, use Power BI Embedded + Service Principal + EffectiveUserName

If this reply helped solve your problem, please consider clicking "Accept as Solution" so others can benefit too. And if you found it useful, a quick "Kudos" is always appreciated — thanks! 

Best Regards, 

Maruthi 

LinkedIn - http://www.linkedin.com/in/maruthi-siva-prasad/ 

X            -  Maruthi Siva Prasad - (@MaruthiSP) / X 

[v-dineshya]

Hi @truttafisker ,

Thank you for reaching out to the Microsoft Community Forum.

1. Enforce RLS in Analysis Services (SSAS)
Since you're using a live connection to Analysis Services, RLS must be implemented in the SSAS model itself, not in Power BI.

This is done by: Defining roles in SSAS.

Using the DAX function USERNAME() or CUSTOMDATA() in the role definition to filter data dynamically.

Example DAX filter in SSAS role:

[Organization] = USERNAME()
But since your users aren't in AD.

2. Use a Gateway + Service Principal / Custom Authentication:
You can't use standard Windows Authentication for non-AD users, so:

Use a Service Principal (Azure AD app) that connects to the SSAS model.

Implement a middle layer (such as an app or web portal) where users authenticate (e.g., with their email or credentials).

Pass the relevant org ID or user ID as CUSTOMDATA() in the SSAS query, which is then used in the RLS logic.

You can pass the org info like this:

[Organization] = CUSTOMDATA()
So your app would authenticate users, determine what org they belong to, and pass that into SSAS securely via the CUSTOMDATA function.

3. Publish a Single Report + Secure Access Per User
You don’t need to create 1000 individual reports. Instead: Publish one report. Use Power BI Embedded or a custom portal to host the report. On embed, securely apply the relevant org/user filter via effective identity / CUSTOMDATA when calling SSAS. This is the most scalable and secure approach.

Can you please refer the below links:

Dynamic row-level security with Analysis services tabular model - Power BI | Microsoft Learn

Dynamic RLS support for Analysis Service Tabular Model based on multiple roles for each user | Micro...

Solved: How does RLS work with SSAS tabular, Power BI Impo... - Microsoft Fabric Community

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[truttafisker]

the solution is not good  ... I have a sass setup and the comments can't be integrated in the repport and visualized in the report .. 

so Im not sure this solution is any good.

[v-dineshya]

Hi @truttafisker ,

Thank you for reaching out to the Microsoft Community Forum.

Please follow below steps:

1. Hybrid Approach (Composite Models in DirectQuery for Power BI datasets and AS)
If you're using Power BI Premium, you can now use DirectQuery for AS + Import or composite models.

This lets you: Use SSAS as a DirectQuery source. Add an imported table (e.g., Comments table from SQL, or API). Join and use that comment data in visuals.

Limitation: This only works with Azure Analysis Services or Power BI datasets — not with traditional on-prem SSAS live connections.

2. External Comments Integration via Custom Visuals or Web Portal: If you're embedding Power BI: Use your custom portal to display the Power BI report side-by-side with a comment section. Comments are handled externally (e.g., via a database or API), filtered by the user/org context. This approach avoids trying to force dynamic data like comments into the SSAS model.

3. Push Comments into the SSAS Model: You could consider synchronizing comments from your app/database into the SSAS cube via ETL (e.g., nightly refresh). This lets comments show up as part of the cube data, but it’s static and not ideal for real-time collaboration.

Note: If integrating user-generated content like comments is a priority, and you want real-time interaction: Move away from a pure SSAS live connection, or Use Power BI Premium composite models, or Handle comments outside of Power BI in an integrated UI/UX layer.

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[v-dineshya]

Hi @truttafisker ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[truttafisker]

no, it didn't work

[v-dineshya]

Hi @truttafisker ,

1. Define Roles with RLS in SSAS

Implement RLS in your SSAS Tabular Model. Use a table in your model (often called UserAccess or UserOrganizationMapping) that maps usernames to the organizations they are allowed to see.

Define DAX filters on your roles:

[Organization] IN VALUES('UserAccess'[Organization])

2. Use EffectiveUserName or Service Principal

Since your users are not in your Active Directory, you can’t directly use their UPNs.

You have two options:

Option A: Use a Gateway and Map External Users to Internal AD Accounts

Create Power BI users in a custom identity store (or receive them manually as you mentioned). Map each external user to a surrogate AD account in your organization. Set up the Power BI Gateway to impersonate the right AD account using EffectiveUserName. This requires configuring your data source with Kerberos constrained delegation.

The SSAS RLS then uses the USERNAME() or USERPRINCIPALNAME() functions to apply the filter.

Option B: Use Service Principal + Row Context Parameter

If you use a service principal to connect to SSAS, you can:

Use a parameter (like an email or org ID) passed into your queries or filtering logic. Let users log in via a custom portal where the parameter is injected into the report via embedding tokens or filters.

Please refer community threads and articles.

Solved: How does RLS work with SSAS tabular, Power BI Impo... - Microsoft Fabric Community

Solved: How to configure SSAS Connection in PowerBI Report... - Microsoft Fabric Community

Row-Level Security in SSAS tabular model - Microsoft Q&A

Dynamic RLS support for Analysis Service Tabular Model based on multiple roles for each user | Micro...

Analysis Services tutorial supplemental lesson: Dynamic security | Microsoft Learn

Dynamic row-level security with Analysis services tabular model - Power BI | Microsoft Learn

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

[truttafisker]

please stop .. your suggestion is not a solution.

[v-dineshya]

Hi @truttafisker ,

I apologize for the issue causing. 

It appears this issue might require deeper investigation from the Power BI support team.

I recommend opening a Microsoft support ticket so they can trace the issue.

To raise a support ticket for Fabric and Power BI, kindly follow the steps outlined in the following guide:

How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn

If my response has resolved your query, please mark it as the "Accepted Solution" to assist others. Additionally, a "Kudos" would be appreciated if you found my response helpful.

Thank you

[v-dineshya]

Hi @truttafisker ,

Could you please confirm if you've created support ticket? 

As we haven’t heard back from you in a long while, we’re closing this thread. For any further discussions or questions, please start a new thread in the Microsoft Fabric Community Forum — we’ll be happy to assist.

Thank you for being part of the Microsoft Fabric Community.

[freginier]

Hey there!

I think your best option would be Row-Level Security (RLS) in Analysis Services, along with a method for user authentication and filtering.

- Since you're using Analysis Services, RLS should be configured in the model, not in Power BI Desktop.

- Define roles in Analysis Services with DAX filters that apply user-specific restrictions.

- Use the USERNAME() or USERPRINCIPALNAME() function in DAX to filter data dynamically based on the logged-in user.

Hope this helps!

😁😁

[Deku]

It sounds like you are building a thin report on top a existing analysis services model.

You would need RLS defined in the analysis services model

[MattiaFratello]

Hi @truttafisker, 

I think your best shot could be to implement Dynamic Row-Level Security (RLS) in Analysis Services.