Forum Discussion
Row Level Security - SSAS/Report Server
When you go to your report on Report Server and click on the ... menu and choose Manage > Data sources - what setting do you see for the Credentials? It needs to say "As the user viewing the report" for RLS to work and you will need to have Kerberos configured. Configure Kerberos to Use Power BI Reports - Power BI | Microsoft Learn
Hi Anonymous,
PBIRS does not pass the viewer’s identity to SSAS because of the current authentication or delegation settings. As a result, SSAS processes RLS using the PBIRS service account or stored credentials, which means RLS is effectively bypassed.
Data source authentication in PBIRS
Go to Report - Manage - Data Sources and set authentication to As the user viewing the report (Windows integrated).
Avoid using stored credentials or an unattended account.
Kerberos (double-hop) setup for PBIRS to SSAS
Register SPNs for the SSAS service account (MSOLAPSvc.*) and the PBIRS service account (HTTP/ReportServerHost).
In Active Directory, for the PBIRS service account:
Delegation - Trust this user for delegation to specified services only - Use Kerberos only / Constrained delegation - add the SSAS MSOLAPSvc.* SPNs.Confirm the identity reaching SSAS
Use SSAS Profiler/XEvent or DMVs to trace while opening the report.
EffectiveUserName should be DOMAIN\actual_user.
If it shows the PBIRS service account, review your delegation and SPN setup.
Role and admin checks
Make sure users are not SSAS Server/DB Admins, since admins bypass RLS.
If your dynamic RLS uses USERNAME(), ensure its format matches your security table (usually DOMAIN\samAccountName). Adjust if you used UPNs or emails.
Model propagation (less common)
If you use many-to-many or bridge tables, check that “Apply security filter in both directions” is enabled where needed.
Quick Diagnostic Flow:
Set PBIRS data source to use viewer’s credentials, open the report, and check SSAS:
If EffectiveUserName equals the viewer, RLS is applied; otherwise, review admin/USERNAME() mapping.
If EffectiveUserName does not match the viewer, resolve SPNs and constrained delegation.
Configure Analysis Services for Kerberos constrained delegation | Microsoft Learn
Configure Kerberos to Use Power BI Reports - Power BI | Microsoft Learn
Authentication methodologies supported by Analysis Services | Microsoft LearnThank you.
Hi everyone
Research Assistance: Expert Survey on Visual Analytics Security and RLS Challenges (12 minutes)
Greetings to our valued Power BI experts,
I am [Mohamed Fawaz Ismail], and I am conducting a specialized study on "Visual Analytics Security" (Secure Visual Analytics). The study aims to identify the actual gaps and risks that developers and analysts face when dealing with sensitive data within dashboards (particularly in relation to RLS, encryption, and Access Control).
Your practical experience in designing and securing dashboards using Power BI is the foundation for the success of this study. Your opinion on questions related to:
Applying the Least Privilege Access principle.
Dealing with accidental data leaks.
The importance of auditing and monitoring (Logging & Auditing).
...It will help us formulate better security standards for the community.
Duration: only about 12 minutes.
Survey link: [https://docs.google.com/forms/d/e/1FAIpQLScUNJwYADW3zyv8HcX4Js8xsLClet4NyogKoYHwanJ4kbY0ww/viewform?usp=header]
Please take a few minutes to participate. I would be happy to share a summary of the results with you later.
Thank you very much for your time and cooperation.
[Mohamed Fawaz Ismail]
