Say [User A] needs to see a Power BI Report, [MyCubeBasedReport] that connects via Live Connection to an AAS Cube, [MyCube]
- [User A] needs at least Viewer permissions in the Workspace containing [MyCubeBasedReport]
- But then [User A] also needs Read permission on any tables/columns in [MyCube] that are used in [MyCubeBasedReport]'s Visuals.
- That seems like a bummer.
- Say I don't want [UserA] to be able to connect to TimesheetTable and get all the details, as that'd expose salaries. But I do want them to be able to view Measures that rely on those columns in TimesheetTable. In [MyCubeBasedReport] it's all rolled up, so fine. But to let them see the rolled up data, I have to give them access to the relevant columns in the TimesheetTable in the Cube - then they could just fire up Power BI, connect, and see the entire column. The only solution being to anonomymize this hypothetical Timesheet table, by putting a restriction on the person.
Am I missing something?
