SSAS Cube Security not working - Always connect as Admin

[e2patrick]

Our customer wants to build PowerBI reports against an existing Multidimensional Cube. We mapped the PowerBi Users (onmicrosoft.com) to AD users in the Data Source settings (CustomData).

This works for Excel and Power BI Desktop but not for Power BI Service.

I checked the profiler: The connection is made with

<EffectiveUserName>Admin account specified in the DataSource</EffectiveUserName><CustomData>Mapped Domain User Name</CustomData>

The problem: Each Power BI User we have tried can see anything. We have set up a Dynamic Security Role with Filters implemented on Dimension Data->Allowed Member set.

It seems to me that the admin account in the EffectiveUserName-Tag overrides the CustomData-account. So every user connect to the cube as an Admin.

Is this a bug. Am I missing something?

[v-shex-msft]

HI @e2patrick,

According to your description, I think the issue may related to your custom data mapping. 

It seems like power bi can't correct mapping users on service side so it use default account which you configured in datasource setting.

I'd like to suggest you use UPN to mapping users and try again:

User Principal Name (UPN) Mapping in Power BI

Regards,

Xiaoxin Sheng

[inayatkhan]

I have similar issues.

I have set the EffectiveUserName to show in the PowerBI logs correctly, and the on premise Power BI Gateway is using ENT\SQL_Analysis account that is a member of the Server Administrators on Analysis Server. However the Flight Record log is showing that the Power BI reports from the Power BI service are accessing the SSAS Analysis services multidimensional cube using "ENT\SQL_Analysis". This is an issue as the dynamic role security using UserName() , MDX command is only finding "ENT\SQL_Analysis" and NOT the  actual user's AD account. Now their AD acccount would be Domain\Username. e.g EU\ELu   however their effective user name is for example. Elaine.Lu@Company.com

So the issues are 

1. Access to the cube by the Analysis server is always the Server admin account ( windows domain account) 

2. Effective User Name is NOT the same as AD Username so , MDX command Username() needs to return the AD account name and not effective user name.

3. Dynamic security is effectively being made ineffective due to points 1 and 2. Ask "Guy in a Cube" , Adam Saxton, how to get dynamic roles using AD accounts on SSAS cubes working with the apparent configuration and limitations of Power BI Gateway.

Regards

Inayat Khan