Azure Analysis Services not allowing domain users to pass through Gateway connection

Question

We have several [REDACTED] models on our Azure Analysis Service. We create on-prem data gateway connection to the model using a service account that is an admin on the SSAS service.

We are running into a situation where users can't pass through the gateway to access the model. We have given them access to the on-prem data gateway.

I was under the impression if the gateway connection has permissions to access the model domain users should not be required to be added to a role on the Model itself.

Is that not true or am I missing something on the gateway connection?

Thanks

Kim Hughes

Answer 1

Hello @Kim Hughes

This is expected behavior for Azure Analysis Services.

Granting users access to the on‑premises data gateway only allows connectivity to on‑premises data sources it does not grant access to the Azure Analysis Services model itself. Authorization is always enforced at the model (database role) level in Azure Analysis Services.

Even if the gateway connection is configured using a service account that is a Server Administrator on Azure Analysis Services, end users must still be explicitly added to a role (Read / Read & Process / Admin) on the SSAS model.

When users connect (for example, via Excel or Power BI), their Microsoft Entra ID identity (EffectiveUserName) is evaluated against the model’s roles. If the user is not a member of a model role, access is denied.

Recommended action is to add the required users (or Entra ID groups) to an appropriate database role on the Azure Analysis Services model using SSMS, TMSL, or PowerShell.

Microsoft References :

1. Manage database roles and users: https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-database-users?view=sql-analysis-services-2025
2. Authentication and user permissions: https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-manage-users?view=sql-analysis-services-2025
3. On‑premises data gateway behavior for Azure Analysis Services : https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-gateway?view=sql-analysis-services-2025

Just checking if provided response was helpful! please let me know if you have any queries.

Answer 2

In your scenario, it seems that users are having trouble accessing the Azure Analysis Services (SSAS) models through the on-premises data gateway, even though the service account used for the gateway connection has the necessary permissions. Here are a few points to consider:

1. Effective User Name: When users connect through the gateway, the effective username that is passed to the SSAS model needs to be valid and have the necessary permissions on the model. If the effective username does not match a local user principal name (UPN) or lacks permissions, users may encounter access issues.
2. Role Assignment: Even if the gateway connection has permissions, users still need to be assigned to a role within the SSAS model to access the data. The gateway does not automatically grant access to all users; they must be explicitly added to a role that has access to the model.
3. Gateway Configuration: Ensure that the data source configuration in the gateway matches the SSAS model's server and database names. Any discrepancies can lead to access issues.
4. Troubleshooting: You can check the effective username being passed to the SSAS server by reviewing the gateway logs. This can help you determine if the correct user is being authenticated and if they have the necessary permissions.
5. User Permissions: Make sure that the users have been granted access to the on-premises data gateway and that they have the appropriate permissions on the SSAS model itself.

If you verify these aspects and still face issues, it may be beneficial to consult with your Power BI admin or local Active Directory admin to ensure that all configurations and permissions are correctly set up.

---

References:

• Embed a report on an on-premises SQL Server Analysis Services (SSAS)
• Troubleshoot on-premises data gateways