How to prevent unwanted access to SSAS source?

[ovonel]

I have a typical fact table with dimensions Project, Profit Center, etc

In a report, I have a table visual that shows individual numbers; and another table shows the department numbers…

It looks something like this:

(Left: personal numbers. Right: department numbers)

My goal is that Tim shouldn’t be able to see someone else’s number, but he definitely can (and should) see the aggregated numbers for his department.

I realized that someone accessing from PowerBI or excel can connect to the model and play with the tables, pick another name and see someone else’s number, therefore I have hidden most tables...

But now, I just realized, someone with access can connect from Visual Studio to the SSAS:

The person can open the .bim, unhide all tables, and with the “analyze from excel” option in VS see any numbers…

Is there any way to avoid/prevent this?

More info:

My model:

(Project table has columns Lead1,Lead2,Lead3,Lead4,Lead5 and Lead6… Engagement Role is just an unpivot of this).

On my left visual I have:

(triggering a more restrictive access).

My RLS:

[NandanHegde]

Rather than hiding the tables, you need to create roles to filter the access for resources based on his/her use case.

https://learn.microsoft.com/en-us/analysis-services/multidimensional-models/roles-and-permissions-an...

https://www.wiseowl.co.uk/blog/s2488/security-roles.htm

[otravers]

That's not the best link since Multidimensional doesn't work in Power BI. Here's the right one:

https://learn.microsoft.com/en-us/analysis-services/tabular-models/roles-ssas-tabular?view=asallprod...

@ovonel you could also use perspectives to define which subsets of your model are viewable to your model, though that's not meant to be a security mechanism:

https://learn.microsoft.com/en-us/analysis-services/tabular-models/perspectives-ssas-tabular?view=as...

Both roles and perspectives are an inheritance from SSAS so they're Power BI Premium only. If you need the equivalent in Power BI Pro, you'll have to implement a combination of RLS and OLS.