Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft is giving away 50,000 FREE Microsoft Certification exam vouchers. Get Fabric certified for FREE! Learn more

Reply
truttafisker
Helper I
Helper I

make report individual for each user that uses the report

hi there 

I have a report which I want to share with alot of people (aprox 1000 users).

I use the analysis service to get my data.

 

.. But I'm not sure how to approach this .. the users should only be allowed to see data that is relevant for their organization.
The users are not added to my AD so I thought of managing their access to the report, by letting them contact me, I add them "somewhere" and somehow restrict their access to the dataset from the analysis service to what's only relevant to them.

.. but I don't know what the most correct way would be .. 

It seems that I can't use the "Manage roles" feature in Power BI desktop, because I'm using the analysis service.

so would the what would the correct approac to this be ?

I'm pretty sure that I'm not the first with this issue, but I can't figure out if RLS, Service Principals or something else would be the best way to do this .. 

4 REPLIES 4
v-dineshya
Community Support
Community Support

Hi @truttafisker ,

Thank you for reaching out to the Microsoft Community Forum.

 

1. Enforce RLS in Analysis Services (SSAS)
Since you're using a live connection to Analysis Services, RLS must be implemented in the SSAS model itself, not in Power BI.

This is done by: Defining roles in SSAS.

Using the DAX function USERNAME() or CUSTOMDATA() in the role definition to filter data dynamically.

Example DAX filter in SSAS role:

[Organization] = USERNAME()
But since your users aren't in AD.

2. Use a Gateway + Service Principal / Custom Authentication:
You can't use standard Windows Authentication for non-AD users, so:

Use a Service Principal (Azure AD app) that connects to the SSAS model.

Implement a middle layer (such as an app or web portal) where users authenticate (e.g., with their email or credentials).

Pass the relevant org ID or user ID as CUSTOMDATA() in the SSAS query, which is then used in the RLS logic.

You can pass the org info like this:

[Organization] = CUSTOMDATA()
So your app would authenticate users, determine what org they belong to, and pass that into SSAS securely via the CUSTOMDATA function.

3. Publish a Single Report + Secure Access Per User
You don’t need to create 1000 individual reports. Instead: Publish one report. Use Power BI Embedded or a custom portal to host the report. On embed, securely apply the relevant org/user filter via effective identity / CUSTOMDATA when calling SSAS. This is the most scalable and secure approach.

 

Can you please refer the below links:

Dynamic row-level security with Analysis services tabular model - Power BI | Microsoft Learn

Dynamic RLS support for Analysis Service Tabular Model based on multiple roles for each user | Micro...

Solved: How does RLS work with SSAS tabular, Power BI Impo... - Microsoft Fabric Community

 

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you

freginier
Solution Sage
Solution Sage

Hey there!

 

I think your best option would be Row-Level Security (RLS) in Analysis Services, along with a method for user authentication and filtering.

- Since you're using Analysis Services, RLS should be configured in the model, not in Power BI Desktop.

- Define roles in Analysis Services with DAX filters that apply user-specific restrictions.

- Use the USERNAME() or USERPRINCIPALNAME() function in DAX to filter data dynamically based on the logged-in user.

Hope this helps!

😁😁

Deku
Community Champion
Community Champion

It sounds like you are building a thin report on top a existing analysis services model.

 

You would need RLS defined in the analysis services model


Did I answer your question?
Please help by clicking the thumbs up button and mark my post as a solution!
MattiaFratello
Responsive Resident
Responsive Resident

Hi @truttafisker

I think your best shot could be to implement Dynamic Row-Level Security (RLS) in Analysis Services.

Helpful resources

Announcements
Notebook Gallery Carousel1

NEW! Community Notebooks Gallery

Explore and share Fabric Notebooks to boost Power BI insights in the new community notebooks gallery.

April2025 Carousel

Fabric Community Update - April 2025

Find out what's new and trending in the Fabric community.

"); $(".slidesjs-pagination" ).prependTo(".pagination_sec"); $(".slidesjs-pagination" ).append("
"); $(".slidesjs-play.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-stop.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-pagination" ).append(""); $(".slidesjs-pagination" ).append(""); } catch(e){ } /* End: This code is added by iTalent as part of iTrack COMPL-455 */ $(".slidesjs-previous.slidesjs-navigation").attr('tabindex', '0'); $(".slidesjs-next.slidesjs-navigation").attr('tabindex', '0'); /* start: This code is added by iTalent as part of iTrack 1859082 */ $('.slidesjs-play.slidesjs-navigation').attr('id','playtitle'); $('.slidesjs-stop.slidesjs-navigation').attr('id','stoptitle'); $('.slidesjs-play.slidesjs-navigation').attr('role','tab'); $('.slidesjs-stop.slidesjs-navigation').attr('role','tab'); $('.slidesjs-play.slidesjs-navigation').attr('aria-describedby','tip1'); $('.slidesjs-stop.slidesjs-navigation').attr('aria-describedby','tip2'); /* End: This code is added by iTalent as part of iTrack 1859082 */ }); $(document).ready(function() { if($("#slides .item").length < 2 ) { /* Fixing Single Slide click issue (commented following code)*/ // $(".item").css("left","0px"); $(".item.slidesjs-slide").attr('style', 'left:0px !important'); $(".slidesjs-stop.slidesjs-navigation").trigger('click'); $(".slidesjs-previous").css("display", "none"); $(".slidesjs-next").css("display", "none"); } var items_length = $(".item.slidesjs-slide").length; $(".slidesjs-pagination-item > button").attr("aria-setsize",items_length); $(".slidesjs-next, .slidesjs-pagination-item button").attr("tabindex","-1"); $(".slidesjs-pagination-item button").attr("role", "tab"); $(".slidesjs-previous").attr("tabindex","-1"); $(".slidesjs-next").attr("aria-hidden","true"); $(".slidesjs-previous").attr("aria-hidden","true"); $(".slidesjs-next").attr("aria-label","Next"); $(".slidesjs-previous").attr("aria-label","Previous"); //$(".slidesjs-stop.slidesjs-navigation").attr("role","button"); //$(".slidesjs-play.slidesjs-navigation").attr("role","button"); $(".slidesjs-pagination").attr("role","tablist").attr("aria-busy","true"); $("li.slidesjs-pagination-item").attr("role","list"); $(".item.slidesjs-slide").attr("tabindex","-1"); $(".item.slidesjs-slide").attr("aria-label","item"); /*$(".slidesjs-stop.slidesjs-navigation").on('click', function() { var itemNumber = parseInt($('.slidesjs-pagination-item > a.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); });*/ $(".slidesjs-stop.slidesjs-navigation, .slidesjs-pagination-item > button").on('click keydown', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); var itemNumber = parseInt($('.slidesjs-pagination-item > button.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); }); $(".slidesjs-play.slidesjs-navigation").on('click', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); }); $(".slidesjs-pagination-item button").keyup(function(e){ var keyCode = e.keyCode || e.which; if (keyCode == 9) { e.preventDefault(); $(".slidesjs-stop.slidesjs-navigation").trigger('click').blur(); $("button.active").focus(); } }); $(".slidesjs-play").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-stop").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-play")) { $(".slidesjs-stop").focus(); } } }); $(".slidesjs-stop").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-play").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-stop")) { $(".slidesjs-play").focus(); } } }); $(".slidesjs-pagination-item").keydown(function(e){ switch (e.which){ case 37: //left arrow key $(".slidesjs-previous.slidesjs-navigation").trigger('click'); e.preventDefault(); break; case 39: //right arrow key $(".slidesjs-next.slidesjs-navigation").trigger('click'); e.preventDefault(); break; default: return; } $(".slidesjs-pagination-item button.active").focus(); }); }); // Start This code is added by iTalent as part of iTrack 1859082 $(document).ready(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); $("#tip2").attr("aria-hidden","true").addClass("hidden"); $(".slidesjs-stop.slidesjs-navigation, .slidesjs-play.slidesjs-navigation").attr('title', ''); $("a#playtitle").focus(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").mouseover(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").blur(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#playtitle").mouseleave(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#play").keydown(function(ev){ if (ev.which ==27) { $("#tip1").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); $("a#stoptitle").focus(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").mouseover(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").blur(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").mouseleave(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").keydown(function(ev){ if (ev.which ==27) { $("#tip2").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); }); // End This code is added by iTalent as part of iTrack 1859082
Top Solution Authors