On-Prem SSAS tabular model row level security with Azure AD only accounts

[jyuan]

Is it possible to set up dynamic row level security on on-prem SSAS tabular models with Azure AD accounts not synced to on-prem AD? If so, how to set it up? Users will consume the tabular model data through Power BI reports with on-prem SSAS tabular model as data source.

[v-alq-msft]

Hi, @jyuan 

If you have an Analysis Services data source, you need to install the gateway on a computer joined to the same forest/domain as your Analysis Services server. 

Each time a user interacts with a report connected to Analysis Services, the effective user name is passed to the gateway and then passed on to your on-premises Analysis Services server. The email address that you use to sign in to Power BI is passed to Analysis Services as the effective user. It's passed in the connection property EffectiveUserName.

The email address must match a defined user principal name (UPN) within the local Active Directory domain. The UPN is a property of an Active Directory account. The Windows account must be present in an Analysis Services role. If a match can't be found in Active Directory, the sign-in isn't successful. 

You may use mapping user names for Analysis Services data sources in different ways:

• Manual user remapping
• On-premises Active Directory property lookup to remap Azure AD UPNs to Active Directory users (Active Directory lookup mapping)

For further information, please refer to the following link. It may help.

https://docs.microsoft.com/en-us/power-bi/service-gateway-enterprise-manage-ssas#map-user-names-for-...

Best Regards

Allan

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[GilbertQ]

Hi there

As far as I know you would need to then manually map the UPN (From the Power BI Service) to the local Domain accounts.

This can be done in the Gateway Data Source settings, under Users, then Map Users. It is a manual process though.