The user account on the gateway data source and UPN translation

[PBInterest]

I am aware of the different ways to map the UPN to the domain credentials, but found a workaround that is not mentioned in the documentation, at least not that I could find.

We are talking about a connection from the Power BI service to an SSAS tabular instance using a Data Gateway. This relates to the Data Source configuration.

When I use an account that has admin permissions on a target SSAS server, the UPN translations happen without additional configuration. If I use a regurlar account instead, one that does not have admin permissions on the SSAS server, I have to setup the user mapping in the data source connection like what is outlined in the documentation.

Can anyone explain this behavior, why an SSAS admin can translate UPN to domain login but a regular user cannot? 

[GilbertQ]

Happy to help!

[GilbertQ]

Hi @PBInterest 

The reason is that an Admin account on the SSAS server is able to use the EffectiveuserName to pass this through to your SSAS Tabular Server.

A non admin account does not have these permissions to be able to do it!

I hope that it helps.

[PBInterest]

Thanks for the reply. Yes we assumed as much with the observed behaviors but wasn't sure why it requred an admin to perform this translation. If you are aware of any documentation around the Admin requirement please let us know. The soltuions Microsoft proposes for UPN mapping would require a lot more work.

Thanks again for responding.

[GilbertQ · Accepted solution]

Hi @PBInterest 

Where are more details for this: Guy in a Cube – How authentication works with Analysis Services live connections | Microsoft P...

[PBInterest]

This answers the question, thank you! I am suprised this is not mentioned in the official documentation though. With that said, it still seems strange that a translation that happens in AD requires an Admin in SSAS. The UPN is part of the AD object so any translation I would imagine happens there. It seems like some kind of additional domain rights are granted automatically to the SSAS admin account. Feel like there are better ways to secure all of this without creating a bunch of extra work. Thanks again for your help.