cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
PBInterest
Frequent Visitor

The user account on the gateway data source and UPN translation

I am aware of the different ways to map the UPN to the domain credentials, but found a workaround that is not mentioned in the documentation, at least not that I could find.

 

We are talking about a connection from the Power BI service to an SSAS tabular instance using a Data Gateway. This relates to the Data Source configuration.

 

When I use an account that has admin permissions on a target SSAS server, the UPN translations happen without additional configuration. If I use a regurlar account instead, one that does not have admin permissions on the SSAS server, I have to setup the user mapping in the data source connection like what is outlined in the documentation.

 

Can anyone explain this behavior, why an SSAS admin can translate UPN to domain login but a regular user cannot? 

1 ACCEPTED SOLUTION

Hi @PBInterest 

 

Where are more details for this: Guy in a Cube – How authentication works with Analysis Services live connections | Microsoft P...





Did I answer your question? Mark my post as a solution!

Proud to be a Super User!







Power BI Blog

View solution in original post

5 REPLIES 5
GilbertQ
Super User II
Super User II

Happy to help!





Did I answer your question? Mark my post as a solution!

Proud to be a Super User!







Power BI Blog

GilbertQ
Super User II
Super User II

Hi @PBInterest 

 

The reason is that an Admin account on the SSAS server is able to use the EffectiveuserName to pass this through to your SSAS Tabular Server.

 

A non admin account does not have these permissions to be able to do it!

 

I hope that it helps.





Did I answer your question? Mark my post as a solution!

Proud to be a Super User!







Power BI Blog

Thanks for the reply. Yes we assumed as much with the observed behaviors but wasn't sure why it requred an admin to perform this translation. If you are aware of any documentation around the Admin requirement please let us know. The soltuions Microsoft proposes for UPN mapping would require a lot more work.

 

Thanks again for responding.

Hi @PBInterest 

 

Where are more details for this: Guy in a Cube – How authentication works with Analysis Services live connections | Microsoft P...





Did I answer your question? Mark my post as a solution!

Proud to be a Super User!







Power BI Blog

View solution in original post

This answers the question, thank you! I am suprised this is not mentioned in the official documentation though. With that said, it still seems strange that a translation that happens in AD requires an Admin in SSAS. The UPN is part of the AD object so any translation I would imagine happens there. It seems like some kind of additional domain rights are granted automatically to the SSAS admin account. Feel like there are better ways to secure all of this without creating a bunch of extra work. Thanks again for your help.

Helpful resources

Announcements
PBI User Groups

Welcome to the User Group Public Preview

Check out new user group experience and if you are a leader please create your group!

MBAS Attendee Badge

Claim Your Badge & Digital Swag!

Check out how to claim yours today!

secondImage

Are You Ready?

Test your skills now with the Cloud Skills Challenge.

Top Solution Authors
Top Kudoed Authors