RLS on SSAS (Import Mode)

[Anonymous]

I am very new on SSAS, based on the document RLS setting on tabular is working on import mode for Power BI. I have some questions on this, please help to address. Thanks in advance.

1) For import mode, if gateway is managed by employee Admin.  B has access to SSAS tabular, have account to model to view some data inside and developed power bi report. C is a normal viewer to the report and has RLS setting on the tabular as well.

If Admin take over the dataset after  B pulished report. RLS on the model won't working anymore? All data in dataset is visible to B and C, right? 

2) For Live mode, it will pass “effective user name” to the SSAS, so it's not a problem. But live mode don't support user to bring in addtional data that he want to analysis. Is there a solution for that?

[v-lili6-msft]

hi @Anonymous 

1) For import mode, RLS won't work for the users(This account) who have edit access to this report, it has no nothing to do with access SSAS tabular, since the data has been imported into power bi dataset.

This only depends on if he/she could edit this report.

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

2) For Live mode, all the RLS seting must been done in the SSAS

https://docs.microsoft.com/en-us/power-bi/desktop-tutorial-row-level-security-onprem-ssas-tabular

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

Regards,

Lin

[Anonymous]

Hi @v-lili6-msft,

Thank you very much, and I am more clear now.

For live connect, does MS has plan to provide dual mode? I mean support live and import in one report. Coz there are a lot of requiement that user need to pull some secured data from SSAS tabular and combined with some data on hand to do analysis.

[v-lili6-msft · Accepted solution]

hi @Anonymous 

It could not achieve that support live and import in one report.

Since you are live connect to a whole data model of SSAS, you could not create or adjust the model in power bi any more.

Regards,

Lin

[alexrobe_aht]

We have a similar issue, where mainly for performance (and report creation speed) issues as well as smaller ETL jobs, we seem to be forced to connect via direct query mode to our SSAS-model.

Is there any way to take over the SSAS rights scheme and import it into PowerBI and somehow use it for RLS on the imported model?

use case:

We have a big global model for multiple plants. Most users shall be restricted to only their plant, some users shall see most/all plants.

Question is: How can the usergroups be maintained (or even created?) automatically, if their access rights settings change in the SSAS model?

Any other approach also welcome to solve this challenge.

Thanks a lot,

Alex

[Anonymous]

Anyone can help?