Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Earn a 50% discount on the DP-600 certification exam by completing the Fabric 30 Days to Learn It challenge.

Reply
e2patrick
New Member

SSAS Cube Security not working - Always connect as Admin

Our customer wants to build PowerBI reports against an existing Multidimensional Cube. We mapped the PowerBi Users (onmicrosoft.com) to AD users in the Data Source settings (CustomData).

This works for Excel and Power BI Desktop but not for Power BI Service.

I checked the profiler: The connection is made with

<EffectiveUserName>Admin account specified in the DataSource</EffectiveUserName><CustomData>Mapped Domain User Name</CustomData>

 

The problem: Each Power BI User we have tried can see anything. We have set up a Dynamic Security Role with Filters implemented on Dimension Data->Allowed Member set.

 

It seems to me that the admin account in the EffectiveUserName-Tag overrides the CustomData-account. So every user connect to the cube as an Admin.

 

Is this a bug. Am I missing something?

2 REPLIES 2
v-shex-msft
Community Support
Community Support

HI @e2patrick,

 

According to your description, I think the issue may related to your custom data mapping. 

It seems like power bi can't correct mapping users on service side so it use default account which you configured in datasource setting.

 

I'd like to suggest you use UPN to mapping users and try again:

User Principal Name (UPN) Mapping in Power BI

 

Regards,

Xiaoxin Sheng

Community Support Team _ Xiaoxin
If this post helps, please consider accept as solution to help other members find it more quickly.

I have similar issues.

 

I have set the EffectiveUserName to show in the PowerBI logs correctly, and the on premise Power BI Gateway is using ENT\SQL_Analysis account that is a member of the Server Administrators on Analysis Server. However the Flight Record log is showing that the Power BI reports from the Power BI service are accessing the SSAS Analysis services multidimensional cube using "ENT\SQL_Analysis". This is an issue as the dynamic role security using UserName() , MDX command is only finding "ENT\SQL_Analysis" and NOT the  actual user's AD account. Now their AD acccount would be Domain\Username. e.g EU\ELu   however their effective user name is for example. Elaine.Lu@Company.com

 

So the issues are 

1. Access to the cube by the Analysis server is always the Server admin account ( windows domain account) 

2. Effective User Name is NOT the same as AD Username so , MDX command Username() needs to return the AD account name and not effective user name.

3. Dynamic security is effectively being made ineffective due to points 1 and 2. Ask "Guy in a Cube" , Adam Saxton, how to get dynamic roles using AD accounts on SSAS cubes working with the apparent configuration and limitations of Power BI Gateway.

 

Regards

Inayat Khan

Helpful resources

Announcements
RTI Forums Carousel3

New forum boards available in Real-Time Intelligence.

Ask questions in Eventhouse and KQL, Eventstream, and Reflex.

MayPowerBICarousel

Power BI Monthly Update - May 2024

Check out the May 2024 Power BI update to learn about new features.

LearnSurvey

Fabric certifications survey

Certification feedback opportunity for the community.

Top Solution Authors
Top Kudoed Authors