Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a role, to restrict access to a cube on Analysis services, so that a member of this role can only see records related to a specific country (from a dim_country dimension). So, for example, they'd only see the records where the dim_country name is 'England', and nothing at all for any other countries.

The issue I'm getting is that all records are being returned, regardless of what I'm putting in. This issue is the case when testing in BIDS (using Test Cube Security) and from Excel when I've added the Roles= into the cube connection definition.

I'd appreciate any suggestions.

The Role Definition I've made the following changes, and replicated it in AdventureWorks General -> Read Definition Checked
Cubes -> Access =Read
-> Local Cube / Drillthrough Access selected

Dimension Data
On the Customer Dimension, in Country
Allowed Member set = [Customer].[Country].&[France]
Denied Member Set = [Customer].[Customer].[All Customers]
Enabled Visual Totals = Ticked.

As I said, the issue is that I'm getting all values returned, rather than those filtered by the country

share|improve this question
up vote 0 down vote accepted

This was caused by a known issue with Roles on SSAS.

The Role security Inheritance on Dimension Data doesn't appear to inherit.

I fixed the issue by going into the Cube Dimension Data dropdown and adding the Allowed Member set in there also. This resolved the issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.