Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
8 years ago
Solved

On-prem SSAS Tabular + Power BI (live connection) + external (non internal AD) users?

Hi all,

 

I'm working my way through the various RLS walkthroughs and wondering if the scenario in the subject is possible.

 

I want to expose power bi dashboards live connected to on-prem SSAS tabular to external users.

 

My first thought was:

1) Crate SSAS read role set to Everyone membership,

2) make the dynamic row level security table as described in various walkthroughs, set relationship filtering as needed using USERPRINCIPALNAME dax function

3) use power bi UPN mapping to map external user to whatever I want that matches a row in the DRLS table in 2

 

Will this general idea work? That is: can I really avoid having a on-prem AD account for external users?

 

Or is there a fault in my logic somewhere and an on-prem AD account is absolutely madatory for the data to flow as I need?

 

Thanks,

sff

Need Help
Tips and Tricks
  • GilbertQ's avatar
    GilbertQ
    8 years ago
    Hi there I have actually implemented this where I am consulting and if you are using SSAS Tabular you unfortunately have to use an AD Account for external users. And then map them in the On-Premise Gateway.

    The reason that this happens is because SSAS Tabular is not connected to Azure Active Directory it is only connected via a local AD Domain. So in order to pass through the authenticated users, it has to ensure that there is an account on the AD Domain.

    If you were using Azure Analysis Services that would work in your example above, this is because it is all leveraging Azure AD.

3 Replies

  • GilbertQ's avatar
    GilbertQ
    Icon for Super User rankSuper User
    8 years ago
    Hi there I have actually implemented this where I am consulting and if you are using SSAS Tabular you unfortunately have to use an AD Account for external users. And then map them in the On-Premise Gateway.

    The reason that this happens is because SSAS Tabular is not connected to Azure Active Directory it is only connected via a local AD Domain. So in order to pass through the authenticated users, it has to ensure that there is an account on the AD Domain.

    If you were using Azure Analysis Services that would work in your example above, this is because it is all leveraging Azure AD.
    • Anonymous's avatar
      Anonymous
      Not applicable
      8 years ago

      Thanks Gilbert.

       

      I'd hoped to be able to ninja the whole thing together myself, but I guess getting the internal AD owners involved is the way it has to be then.

       

      Appreciate the tip!

      sff

  • v-jiascu-msft's avatar
    v-jiascu-msft
    Icon for Microsoft Employee rankMicrosoft Employee
    8 years ago

    Hi Anonymous,

     

     You can map the external user to an internal AD user in the data gateway.

     

    Best Regards,

    Dale