Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Earn the coveted Fabric Analytics Engineer certification. 100% off your exam for a limited time only!

Reply
kadingo
Helper II
Helper II

How does RLS work with SSAS tabular, Power BI Import connection and power bi service

May some one help me understand how row level security that has been implemented at SSAS tabular model level work with power BI reports published to the power BI service when the reports are using import connection method (NOT live connection).

 

I'm at the start of a project that is going to use SSAS tabular model and one of the requirements is that row level security is a must. 

If i want to do things right from the beginning, is it ok to just implement row level security at the SSAS cube, then use any power bi connection method (live or import) and everything will play nice when i publish and share my reports, datasets and dashboards in the service.

 

My goal is to get this right early before time and resources are wasted but searches can't seem to find any official clear direction about this.

1 ACCEPTED SOLUTION

Hi, @kadingo 

 

If your data source already has security roles defined and you are using import data into your Power BI dataset, the security roles in your data source aren't used. In this case, you should define RLS to enforce security rules for users who connect in Power BI. And in the Import mode, the data source content is cached into the desktop, so it has nothing to do with the original source. Unlike DQ and LC, it is also equivalent to real time.

 

Best Regards

Allan

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 

View solution in original post

6 REPLIES 6
v-alq-msft
Community Support
Community Support

Hi, @kadingo 

 

If you import data from SSAS into Power BI Desktop, you can define roles and rules in Power BI Desktop and then validate the role within Power BI Service. If you are using a live connection to SSAS, you won't be able to configure RLS within Power BI Service. It is defined within the SSAS model on-premises.

 

For further information, you may refer to the following links.

https://docs.microsoft.com/en-us/power-bi/desktop-tutorial-row-level-security-onprem-ssas-tabular

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

 

Best Regards

Allan

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

@v-alq-msft  You mention that 


@v-alq-msft wrote:

Hi, @kadingo 

 

If you import data from SSAS into Power BI Desktop, you can define roles and rules in Power BI Desktop and then validate the role within Power BI Service. If you are using a live connection to SSAS, you won't be able to configure RLS within Power BI Service. It is defined within the SSAS model on-premises.

 

For further information, you may refer to the following links.

https://docs.microsoft.com/en-us/power-bi/desktop-tutorial-row-level-security-onprem-ssas-tabular

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

 

Best Regards

Allan

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.


Does this mean i can not take advantage of RLS defined within the SSAS model on-premises if i import data from SSAS into Power BI Desktop?.

 

I have existing reports using import method and i plan to define  RLS within my SSAS model on-premises, can those existing reports take advantage of RLS that is going to be defined within my SSAS model on-premises OR i will have to redesign those reports using live connection to be able to take advantage of RLS defined at the model.

 

The important think to note here is that i have existing reports that are using import method and RLS will be defined within my SSAS model on-premises. Will my reports be able to use that RLS or i will have to redesign them using live connection?

 

 

Hi, @kadingo 

 

If your data source already has security roles defined and you are using import data into your Power BI dataset, the security roles in your data source aren't used. In this case, you should define RLS to enforce security rules for users who connect in Power BI. And in the Import mode, the data source content is cached into the desktop, so it has nothing to do with the original source. Unlike DQ and LC, it is also equivalent to real time.

 

Best Regards

Allan

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 

Hi @kadingo ,

 

if you imported the data into Power BI, you configure RLS with Power BI Desktop.

If you use a live connection, you configure RLS on the on-premises model.

 

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

 

Did I answer your question?
Please mark my post as solution, this will also help others.
Please give Kudos for support.

Marcus Wegener works as Full Stack Power BI Engineer at BI or DIE.
His mission is clear: "Get the most out of data, with Power BI."
twitter - LinkedIn - YouTube - website - podcast


@mwegener  So its correct to take it that RLS implemented on the SSAS on-premises model does not work when one is using import connection method in Power BI desktop, right?. If i want RLS in the power BI service and i have implemented it at the SSAS on-premises model, then i MUST buld my reports in power bi desktop using live connection only NOT import, correct?

Hi @kadingo ,

 

yes. If you import the data, you create a new model with a new security layer.

Did I answer your question?
Please mark my post as solution, this will also help others.
Please give Kudos for support.

Marcus Wegener works as Full Stack Power BI Engineer at BI or DIE.
His mission is clear: "Get the most out of data, with Power BI."
twitter - LinkedIn - YouTube - website - podcast


Helpful resources

Announcements
April AMA free

Microsoft Fabric AMA Livestream

Join us Tuesday, April 09, 9:00 – 10:00 AM PST for a live, expert-led Q&A session on all things Microsoft Fabric!

March Fabric Community Update

Fabric Community Update - March 2024

Find out what's new and trending in the Fabric Community.