Live connection to SSAS

Hi XeniaLi 

The recurring error you're encountering when using a live connection to an SSAS (SQL Server Analysis Services) model through Power BI Report Server, as shown in your screenshots, is typically caused by transient network or authentication-related issues between the Report Server and the SSAS server. The error message We couldn't connect to the Analysis Services server along with Access token expired or ConceptualSchemaProxy.execute failures indicates that, at the time of accessing the report, the user's identity or token used for RLS (Row Level Security) validation could not be successfully passed to SSAS.

Since the issue is intermittent and resolves on its own, it’s likely not a misconfiguration but rather an environment-related inconsistency. This can stem from several common factors:

Kerberos Delegation: Live connections with RLS require Kerberos to correctly delegate the user identity from the report server to the SSAS server. If Kerberos is not set up consistently across all access routes (especially when using an alias or DNS CNAME for Report Server), users might fail to authenticate intermittently.

Token Expiry and Session Caching: If the user’s authentication token expires or is not refreshed in time (especially in distributed setups or long sessions), the server can return token-related errors, which would match the “access token expired” part of your log.

DNS Alias and SPNs: If you're using an alias (friendly URL), ensure that the alias is properly configured with a registered SPN (Service Principal Name) for Kerberos, and the delegation is set up from the Power BI Report Server service account to the SSAS service account.

Recommendations:

Ensure Kerberos is configured correctly with proper SPNs and constrained delegation set up between Report Server and SSAS.

Validate that the Report Server and SSAS are on the same domain and that user delegation is allowed.

Review SPNs using setspn -L <ServiceAccount> for both SSAS and Power BI Report Server accounts.

If you're using a custom alias, ensure it resolves correctly on all client machines and is covered under the SPNs.

Consider using Network Monitor or Fiddler to trace the traffic when the error occurs to confirm if it’s Kerberos failure.

Ensure users are accessing the report server using the fully qualified domain name (FQDN), not just the alias or short name.

This kind of setup is sensitive to network environment and domain configuration, so even if the setup is correct in principle, any minor inconsistency (like a missing SPN for the alias) can cause the exact intermittent behavior you're seeing.