Reading SSAS Tabular Row Level Security in SSMS

I am a relative newbie with SSAS Tabular. I needed to find the Row Level Security rules for a role in our SSAS instance. I have experimented with Row Level Security using Visual Studio, but Visual Studio is not set up yet in our environment. However, I learned it is quite easy to find this information using SQL Server Management Studio (SSMS).

A quick overview of Row Level Security (RLS) in SSAS tabular. You can create roles with members from you active directory. You assign permissions for various objects to these roles. However, you can also assign permission for specific rows in tables (Row Level Security). Configure Analysis Services tabular model roles | Microsoft Docs. To implement RLS, you create a DAX expression on every table that you want to filter. The DAX will return true for a row if the row is available to that user.

It is surprisingly easy to use SSMS to view the Row Level Security rules. First you open SSMS and connect to the SSAS tabular model using an administrator login. Then you drill down to the database with the roles you need to modify. You then expand the roles.

Expanding folders in SSAS tabular database
Find roles

You can double click on the role you want to view or right click and select properties.

Context menus for Role
Context menu

You click on properties. There are three tabs for this.

When you click on the first tab, you see the object permissions that the role has.

This displays the properties of the SSAS tabular role, including object permisions
Properties and Object Permissions

When you click on the second tab, you see members of the role. You can add a member on this form.

Members tab of the roles property page in SSAS tabular
Add members

The third page allows you to view the DAX expressions that are used to filter the rows for each table.

This shows the row filters, a series of DAX expressions
Row Filters

You can click on any of the DAX filters a see what expression is being used.

You can also click on the Script button at the top to export the JSON definition for the Role, which includes all of the Row Filters. It also includes table permissions and column permissions that don’t show in the Propertied General tab.

This is a real timesaver when coming into a new environment. Let me know in the comments if SSMS hides other gems related to SSAS tabular.

Leave a Reply