Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Find everything you need to get certified on Fabric—skills challenges, live sessions, exam prep, role guidance, and more. Get started

Reply
ovonel
Post Prodigy
Post Prodigy

How to prevent unwanted access to SSAS source?

I have a typical fact table with dimensions Project, Profit Center, etc

 

In a report, I have a table visual that shows individual numbers; and another table shows the department numbers…

 

It looks something like this:

ovonel_0-1672221542865.png

(Left: personal numbers. Right: department numbers)

 

 

 

My goal is that Tim shouldn’t be able to see someone else’s number, but he definitely can (and should) see the aggregated numbers for his department.

 

I realized that someone accessing from PowerBI or excel can connect to the model and play with the tables, pick another name and see someone else’s number, therefore I have hidden most tables...

 

But now, I just realized, someone with access can connect from Visual Studio to the SSAS:

ovonel_1-1672221573918.png

 

 

 

 

 

The person can open the .bim, unhide all tables, and with the “analyze from excel” option in VS see any numbers…

 

Is there any way to avoid/prevent this?

 

More info:

My model:

ovonel_2-1672221602526.png

(Project table has columns Lead1,Lead2,Lead3,Lead4,Lead5 and Lead6… Engagement Role is just an unpivot of this).

 

 

On my left visual I have:

ovonel_3-1672221622726.png

 

(triggering a more restrictive access).

 

 

My RLS:

ovonel_4-1672221647794.png

 

 

2 REPLIES 2
NandanHegde
Super User
Super User

Rather than hiding the tables, you need to create roles to filter the access for resources based on his/her use case.

https://learn.microsoft.com/en-us/analysis-services/multidimensional-models/roles-and-permissions-an...

 

https://www.wiseowl.co.uk/blog/s2488/security-roles.htm

That's not the best link since Multidimensional doesn't work in Power BI. Here's the right one:

https://learn.microsoft.com/en-us/analysis-services/tabular-models/roles-ssas-tabular?view=asallprod...

 

@ovonel you could also use perspectives to define which subsets of your model are viewable to your model, though that's not meant to be a security mechanism:

https://learn.microsoft.com/en-us/analysis-services/tabular-models/perspectives-ssas-tabular?view=as...

 

Both roles and perspectives are an inheritance from SSAS so they're Power BI Premium only. If you need the equivalent in Power BI Pro, you'll have to implement a combination of RLS and OLS.

------------------------------------------------
1. How to get your question answered quickly - good questions get good answers!
2. Learning how to fish > being spoon-fed without active thinking.
3. Please accept as a solution posts that resolve your questions.
------------------------------------------------
BI Blog: Datamarts | RLS/OLS | Dev Tools | Languages | Aggregations | XMLA/APIs | Field Parameters | Custom Visuals

Helpful resources

Announcements
July 2024 Power BI Update

Power BI Monthly Update - July 2024

Check out the July 2024 Power BI update to learn about new features.

PBI_Carousel_NL_June

Fabric Community Update - June 2024

Get the latest Fabric updates from Build 2024, key Skills Challenge voucher deadlines, top blogs, forum posts, and product ideas.