Showing results for 
Search instead for 
Did you mean: 
e2patrick Visitor

SSAS Cube Security not working - Always connect as Admin

Our customer wants to build PowerBI reports against an existing Multidimensional Cube. We mapped the PowerBi Users ( to AD users in the Data Source settings (CustomData).

This works for Excel and Power BI Desktop but not for Power BI Service.

I checked the profiler: The connection is made with

<EffectiveUserName>Admin account specified in the DataSource</EffectiveUserName><CustomData>Mapped Domain User Name</CustomData>


The problem: Each Power BI User we have tried can see anything. We have set up a Dynamic Security Role with Filters implemented on Dimension Data->Allowed Member set.


It seems to me that the admin account in the EffectiveUserName-Tag overrides the CustomData-account. So every user connect to the cube as an Admin.


Is this a bug. Am I missing something?

Community Support Team
Community Support Team

Re: SSAS Cube Security not working - Always connect as Admin

HI @e2patrick,


According to your description, I think the issue may related to your custom data mapping. 

It seems like power bi can't correct mapping users on service side so it use default account which you configured in datasource setting.


I'd like to suggest you use UPN to mapping users and try again:

User Principal Name (UPN) Mapping in Power BI



Xiaoxin Sheng

Community Support Team _ Xiaoxin Sheng
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

For learning resources/Release notes, please visit: | |
inayatkhan Frequent Visitor
Frequent Visitor

Re: SSAS Cube Security not working - Always connect as Admin

I have similar issues.


I have set the EffectiveUserName to show in the PowerBI logs correctly, and the on premise Power BI Gateway is using ENT\SQL_Analysis account that is a member of the Server Administrators on Analysis Server. However the Flight Record log is showing that the Power BI reports from the Power BI service are accessing the SSAS Analysis services multidimensional cube using "ENT\SQL_Analysis". This is an issue as the dynamic role security using UserName() , MDX command is only finding "ENT\SQL_Analysis" and NOT the  actual user's AD account. Now their AD acccount would be Domain\Username. e.g EU\ELu   however their effective user name is for example.


So the issues are 

1. Access to the cube by the Analysis server is always the Server admin account ( windows domain account) 

2. Effective User Name is NOT the same as AD Username so , MDX command Username() needs to return the AD account name and not effective user name.

3. Dynamic security is effectively being made ineffective due to points 1 and 2. Ask "Guy in a Cube" , Adam Saxton, how to get dynamic roles using AD accounts on SSAS cubes working with the apparent configuration and limitations of Power BI Gateway.



Inayat Khan

Helpful resources

Community Kudopalooza

Win Power BI Swag with Community Kudopalooza!

Each week, complete activities and be qualified in the drawing for cool Power BI Swag.

Summit North America

Power Platform Summit North America

Register by September 5 to save $200

Virtual Launch Event

Microsoft Business Applications Virtual Launch Event

Watch the event on demand for an in-depth look at the new innovations across Dynamics 365 and the Microsoft Power Platform.

MBAS Gallery

Watch Sessions On Demand!

Continue your learning in our online communities.

Top Kudoed Authors
Users Online
Currently online: 120 members 1,540 guests
Please welcome our newest community members: