Row Level Security (RLS) SSAS Live Connection

[TheOckieMofo]

Power BI Nation,

I have created a SSAS Tabular cube (SQL Server '16) and am building a .pbix file via a live connection. Everything works fine except for the security once I publish file to my app workspace on the PBI service. I have an enterprise gateway set up and the end users of the report have been added to security on the SSAS cube.

So what's the problem? The end users cannot view the content of the app unless if map their user names to that datasource in the gateway admin portal. So basically, every end user I want to distribute this report to, I have to not only add them to security on the SSAS cube, but I also have to map their username in the service? This seems like a huge hassle and an administrative nightmare. What am I doing wrong? Or is this how the process is designed? I would imagine the intent from Microsoft is to only have to add users to security in the underlying SSAS cube and not have to map their user names?

[Anonymous]

Hi @TheOckieMofo,

>>The end users cannot view the content of the app unless if map their user names to that datasource in the gateway admin portal. 

If these users mean external users, you can take a look at following link about add external user as guest to apply RLS effect:

Distribute Power BI content to external guest users with Azure AD B2B

Regards,

Xiaoxin Sheng

[TheOckieMofo]

No, these are users within my company on my domain. However, this issue is that Power BI passes an email address to SSAS; however, SSAS tabular only lets you set up security by inputing the users User Principal Name (I hope that's the correct terminology). The UPN in our company looks like Domain\username. It does not look like an email address at all. So that's the problem, SSAS doesn't know what to do with the email address it gets from Power BI.

[GilbertQ]

You can then map usernames when you configure the data source on the gateway in the Power BI service.

Adam Saxton aka Guy in a Cube has a video with regards to this as well as it is detailed in the Microsoft docs

[GilbertQ]

Hi there, if you set it in the Map User Names to "CustomData" and ensure that you have mapped your RLS via the UPN that would then work.

I have currently done that on my SSAS 2017 instance which makes it a lot easier in terms of managing the users.