On Premises Data Gateway - Options for Authenticating To Analysis Services Data Source

[rhardy]

Hi,

Is it possible for a user to view a Power BI Report that is connected to a Analysis Services Datasource via the On Premisise Data Gateway, but NOT have access to the datasource itself?

I would like to explain our situation / issue to see if I am understanding this correctly and if anyone has any suggestions.  We have a Data Cube on Anlysis Services that has complex and sensitive data in it.  We have several "Power Users" in our company who understand the data well, and want to build reports / dashboards off of it, that they can share with their departments ("End Users").  The Power Users are the only ones who we want to give access to the Data Cube, because we don't want an end user to be emailed a spreadsheet and change a report, as they could create an incorrect report, by removing an important filter for example, and make decisons based on incorrect data.

We were hoping this is where Power BI could help us.  We have built some reports in Power BI.   The Power BI Reports are connected to the Analysis Services Datasource via the On Premisise Data Gateway.  We then shared the report with the end users via an App.  The end user has a liscence to Power BI Pro, access to the App but not the data source.  The Gateway Data Source is using an Admin Account for authentication.  

When the end users opens the Report from the App, none of the visuals display for them, I beleive because they do not have access the datasource.  

Is there anyway, that we can have Power BI authenticate to the data source with differerent credentials than the user has logged in to Power BI with?   We want to share the data with users on our terms, we don't want the users to be able to get access to the data and build their own reports off of it.  If we give access to the Data Cube for Power BI reasons, they could potentially connect to the same data source via Excel, which we don't want.

Thanks,
Robin

[v-yuezhe-msft · Accepted solution]

@rhardy,

You can use map user name feature to map end users with Power user, this way, as long as the end users don't know the account and password of the power user, then end users will not be able to access the SSAS data source, meanwhile, end users are able to view reports in Power BI Service

Regards,
Lydia

[weightj]

What about in the case of doing row level security? For instance if I change the mapping of the user running the report to a service account (same idea as presented on your post to a power user) on our domain that has access to the cube in a certain role that has Dynamic RLS logic. The system will not recognize the user running the report, just the service account. A thought that I had, was hoping that I could pass in the CustomData field which would pass in the user running the report, just like we can on SSRS. But since I put a rule on the Effective user name to map the user to a power user or service account, I can't select CustomData so that it will send that information over in the connection string. Thoughts? 

[rhardy]

Thanks @v-yuezhe-msft!  I just tested this feature and it works great.  Appreciate your help.

Robin

[v-yuezhe-msft]

@rhardy,

Glad to hear the issue is solved, please accept my reply as answer to close this thread.

Regards,
Lydia