Dynamic Role Level Security in SSAS Multidimensional model to Power BI Embedded with live connection

[Anonymous]

I am trying to setup Dynamic Row Level Security in an on premise SSAS Multidimensional model. I setup a live connection to Power BI Embedded ('App owns data' method) using a 'master user' instead of the service principal (no big reason for that, just service principal is newer and I thought there is bigger chance of issues). When getting the token through an API, it works without the RLS. When i add RLS, it gives an error: 

"Couldn't retrieve the data for this visual. Please try again later."

I setup RLS through this topic: https://community.powerbi.com/t5/Developer/RLS-with-Power-BI-Embedded-and-SSAS-Multidimensional/td-p...

and this information: 

https://docs.microsoft.com/en-us/power-bi/developer/embedded-row-level-security

Since I am working with an on premise SSAS Multidimensional model, it's not possible to add roles in Power BI Desktop and CustomData() option isn't available:

"Using the CustomData feature

The CustomData feature only works for models that lie in Azure Analysis Services, and it only works in Connect live mode. Unlike users and roles, the Custom data feature can't be set inside a .pbix file. When generating a token with the Custom data feature, you need to have a username."

I added a new role in SSAS, added the 'master user' to this role, added read permissions and set the following MDX syntax in the 'Allowed member set' of the company dimension:

STRTOMEMBER('[Dim Company].[BK_Company].&[{'+USERNAME()+'}]')

So I used the UserName() function to pass the BK_Company value in the API when generating the token in the portal (the 'app' which is used to embed the Power BI reports), which I want to use to filter.

Any thoughts..?

[Anonymous]

After contacting Power BI Support the issue got fixed. 

Solution:

The solution was to disable the option 'enable read permissions' in the 'Cell data' tab of the used role.

Reason:

There probably has been some code there in the past which doesn't totally get erased under water, although it looks like it's gone. This gives an error message when connecting. After disable the check box, the connection worked.