How to prevent access to SSAS? "analyze in excel" feature can bypass security

Question

I have a typical fact table with dimensions Project, Profit Center, etc

In a report, I have a table visual that shows individual numbers; and another table shows the department numbers…

It looks something like this:

][2]

(Left: personal numbers. Right: department numbers)

My goal is that Tim shouldn’t be able to see someone else’s number, but he definitely can (and should) see the aggregated numbers for his department.

I realized that someone accessing from PowerBI or excel can connect to the model and play with the tables, pick another name and see someone else’s number, therefore I have hidden most tables...

But now, I just realized, someone with access can connect from Visual Studio to the SSAS:

The person can open the .bim, unhide all tables, and with the “analyze from excel” option in VS see any numbers…

Is there any way to avoid/prevent this?

More info:

My model:

(Project table has columns Lead1,Lead2,Lead3,Lead4,Lead5 and Lead6… Engagement Role is just an unpivot of this).

On my left visual I have:

(triggering a more restrictive access).

My RLS:

Answer 1

It's not tabular model security if it can be bypassed by connecting an unrestricted client application, excel or otherwise. Note that it requires administrator permission to the model for such bypass to happen at all.

Answer 2

Hi @ovonemty

Maybe you can try creating roles and giving them the appropriate permissions to manage them.

You can refer to this link to try it.manage-roles-by-using-ssms-ssas-tabular

Best regards,
Percy Tang

----------

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our Documentation to enable e-mail notifications if you want to receive the related email notification for this thread.