SSAS Row Level Security Prototype | Vision and Scope Document

1. Vision and Scope Document | SSAS Prototype
Row Level Security (RLS)
Version 1.0

2. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 2 of 9
Vision
Pam Lehmann and Brian Leslie have identified a need to provide Row Level Security (RLS) a Microsoft Application (SQL
Server Analysis Services [SSAS]) to service new and existing Sales, Finance, and Operations reports. The source for these
reports originate from TricorBraun’s ERP system Microsoft Dynamics 365. There are two Dynamics 365 applications that
are currently being considered as sources for this initiative. These Dynamics 365 applications are Sales (CRM) and
Finance and Operations. Below are the identified Executive Leadership and Stakeholders from TricorBraun:
• Jeff Douglas, VP Sales Effectiveness
• Bill Stultz, VP of Finance for System’s Controller, Finance (Executive Champion)
• Dave Duxbury, VP of Operations, GSC – Logistics (Executive Champion)
• Doug Bolen, Chief Information Officer
• Pam Lehmann, Director, Applications, IT
• Brain Leslie, Senior Reporting Analyst, IT
• Donovan Foster, IT Consultant, PMO, IT
• Sarah Thomason, Project Manager
• Mike Lang, Consultant - RSM
Due to the complexity of this initiative, it has been decided to complete an Azure Analysis Services RLS Prototype before
we complete the final, expanded Vision Scope Document and the final Design Document. This Vision Scope Document is
of limited scope just for the prototype. As the team at TricorBraun identify and finalize the expanded scope, we will
document and append to an Expanded Vision Scope Document intended for the final design and development, not the
prototype.
It has been decided to use the existing Invoicing Data Mart as our source for the prototype mentioned above. We will be
using one (1) existing fact table (FactInvoiceDetail) along with twenty-five (25) existing dimensions. The number of
dimensions for this prototype should be reduced to the minimal dimensions required to accomplish the goals of the
prototype. Since there are no usable Power BI reports to use to test the Azure Analysis Services RLS prototype, a simple
test Power BI report will be created for testing purposes. To accompany this Vision Scope Document (limited scope), we
will be conducting a Data Discovery and Analysis that will include a Bus Matrix and Conceptual Models to illustrate the
design of the SSAS RLS prototype design pattern being applied to the Invoicing Data Mart. It has been decided that this
prototype will apply Azure Analysis Services RLS against the Division, Region, and Customer dimensions.
Approach
The Azure Analysis Services RLS prototype will require multiple test personas (AD Users) that belong to AD Groups.
These AD Groups should represent persona roles for entire company, division, region, branch, and customer. The AD
Security Groups need to be created with a UPN to be used with Azure Analysis Services. Azure Analysis Services and
Visual Studio 2017 will be used to develop the RLS prototype. The prototype requires us to implement a custom security
schema where user roles and the user's place in the organization are used to determine which divisions, regions, and
customers a user can access. The prototype will use a user security table and a security bridge table to apply RLS to the
user's place in the organization for only one (1) of the following: divisions, regions, or customers for any given user.
Our goal for these prototypes is to apply RLS to the most common security scenario, not the exceptions. We have agreed
to the idea that the prototypes should target the 80/20 business rule.

3. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 3 of 9
Deliverables
Azure Analysis Services RLS has one (1) deliverable:
• Development RLS Prototype for Azure Analysis Services Start Date: TBD End Date: TBD
o Multiple personas plus Business User Personas
o A complex security model using customer dimension (dimension to apply RLS), a bridge table, and a User (contains
User Login ID and AD Group Name) table. This design uses Bi-Directional Cross Filtering & support Direct Query
o Uses dynamic row level security filters
o Uses production data for three (3) business defined security dimension (Division, Region, and Customer)
o Manual process to load the security bridge table and the security User table with test data (minimal rows)
o 1 Simple, Test Power BI Report to Test SSAS RLS
Clarifications
These are the clarification for the RLS project:
• The business and IT teams will develop and maintain three (3) business defined division, region, & customer dimensions
• The business and IT teams will develop and maintain three (3) security bridge tables and ETL for these Bridge tables
• The business and IT teams will develop and maintain one (1) security User table and ETL for this User table
• The business and IT teams will develop and maintain one (3) security User views (division, region, & customer)
• The business and IT teams will maintain (after initial development) four (4+) SSAS Roles
o SSAS Roles for Division, Region, Customer, and Total Company
• The business and IT teams will develop and maintain one (1) Invoice Star Schema and ETL for that Star Schema
• The Power BI (SSAS) prototype and development for RLS will use the division, region, and customer dimensions
(dimensions to apply RLS), a bridge table, and a User (contains User Login ID and AD Group Name) table. This deliverable
uses Bi-Directional Cross Filtering and will support direct query.
• A simple, test Power BI report to test SSAS RLS (1 Fact and no more than 5 dimensions) will be created. Anything more
complex will be up to the business and IT teams to develop, unless additional time is provided for such development
• Effort estimates are based on 100% resource utilization. Sprints with less than 100% resource utilization, unplanned
maintenance, or non-concurrent development blocks of time may result in increased timelines and end dates.
How to get the Job Done
We will be using the following processes and tools to complete this project and deliverables:
• Azure DevOps (VSTS)
• Team Foundation Services, or Git (TBD), since both are used at TricorBraun for Source Control and Change Management
• We are limiting the work-in-progress by using properly planned deliverables
• PBIs, Tasks, and Kanban Boards will be used as part of Azure DevOps (VSTS)
o Product backlog
o Tasks
o Weekly PowerPoint Updates
o Sprints are not used at TricorBraun
• A scope change log for this document will be used to manage change in an Agile fashion
o Name
o Description (Impact)
o Version
o Requested By
o Approved By
o Date

4. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 4 of 9
Change Log
Name Description (Impact) Version Requested By Approved By Date

5. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 5 of 9
Appendix A | Azure Analysis Services, RLS Security Model
The RLS prototype and development use a complex security model using division, region, and customer dimensions
(dimensions to apply RLS), bridge tables, and User (contains User Login ID and AD Group Name) tables / views.
Invoice
Detail
Customer
Date
Branch Division
Region
Customer_Group
Bridge
Customer User
(AD User Name
AD Group)
Bi-Directional
Cross Filter
Division_Group
Bridge
Division User
(AD User Name
AD Group)
Region_Group
Bridge
Region User
(AD User Name
AD Group)
Bi-Directional
Cross Filter
Bi-Directional
Cross Filter
Tricor Braun SSAS Security Model (RLS)
=USERNAME(Division User[AD User Name])
DAX Security Filter Example
=USERNAME(Division User[AD User Name])
DAX Security Filter Example
Invoice
Detail
Customer
Date
Branch Division
Region
Customer_Group
Bridge
Customer User
(AD User Name
AD Group)
Bi-Directional
Cross Filter
Division_Group
Bridge
Division User
(AD User Name
AD Group)
Region_Group
Bridge
Region User
(AD User Name
AD Group)
Bi-Directional
Cross Filter
Bi-Directional
Cross Filter
Tricor Braun SSAS Security Model (RLS)
=USERNAME(Division User[AD User Name])
DAX Security Filter Example
* Note: Model is a subset of the actual dimensions to demonstrate how the new security tables integrate with the existing model.

6. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 6 of 9
Appendix B | DimDivision, Division Security Bridge and User Security Table
Division Security BridgeDivision Security Bridge
User SecurityUser Security
DimDivisionDimDivision
Fact Invoice DetailFact Invoice Detail
Row Level Security | DimDivision, Division Security Bridge and User Security Table
AD Group NameAD Group NamePKPK
DivisonSecurityIDDivisonSecurityIDPKPK
AD User NameAD User NamePKPK
AD Group NameAD Group Name
DivisionKeyDivisionKeyPKPK
DivisionDescriptionDivisionDescription
DivisionIDDivisionID
DivisonSecurityIDDivisonSecurityID
SortOrderSortOrder
IsActiveIsActive
CompanyKeyCompanyKeyPKPK
DivisionKeyDivisionKeyPKPK
RegionKeyRegionKeyPKPK
BranchKeyBranchKeyPKPK
Additional PKs...Additional PKs...PKPK
attribute names...attribute names...
** Division Security ID is the current Division IDs Only (no history)
Division Security Bridge
User Security
DimDivision
Fact Invoice Detail
Row Level Security | DimDivision, Division Security Bridge and User Security Table
AD Group NamePK
DivisonSecurityIDPK
AD User NamePK
AD Group Name
DivisionKeyPK
DivisionDescription
DivisionID
DivisonSecurityID
SortOrder
IsActive
CompanyKeyPK
DivisionKeyPK
RegionKeyPK
BranchKeyPK
Additional PKs...PK
attribute names...
** Division Security ID is the current Division IDs Only (no history)
Division Security BridgeDivision Security Bridge
User SecurityUser Security
DimDivisionDimDivision
Fact Invoice DetailFact Invoice Detail
Row Level Security | DimDivision, Division Security Bridge and User Security Table
AD User NameAD User NamePKPK
DivisonSecurityIDDivisonSecurityIDPKPK
AD User NameAD User NamePKPK
DivisionKeyDivisionKeyPKPK
DivisionDescriptionDivisionDescription
DivisionIDDivisionID
DivisonSecurityIDDivisonSecurityID
SortOrderSortOrder
IsActiveIsActive
CompanyKeyCompanyKeyPKPK
DivisionKeyDivisionKeyPKPK
RegionKeyRegionKeyPKPK
BranchKeyBranchKeyPKPK
Additional PKs...Additional PKs...PKPK
attribute names...attribute names...
** Division Security ID is the current Division IDs Only (no history)
Division Security Bridge
User Security
DimDivision
Fact Invoice Detail
Row Level Security | DimDivision, Division Security Bridge and User Security Table
AD User NamePK
DivisonSecurityIDPK
AD User NamePK
DivisionKeyPK
DivisionDescription
DivisionID
DivisonSecurityID
SortOrder
IsActive
CompanyKeyPK
DivisionKeyPK
RegionKeyPK
BranchKeyPK
Additional PKs...PK
attribute names...
** Division Security ID is the current Division IDs Only (no history)

7. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 7 of 9
Appendix C | Security Division ID
-- [Invoicing].[dbo].[DimDivision] with SecurityDivisionID
SELECT TOP (1000) [DivisionKey]
,[DivisionId]
,CASE
WHEN [DivisionId] = 'Central' THEN 'Central'
WHEN [DivisionId] = 'Div_CCE' THEN 'Div_CCE'
WHEN [DivisionId] = 'Div_Intl' THEN 'Div_Intl'
WHEN [DivisionId] = 'Div_MNA' THEN 'Div_MNA'
WHEN [DivisionId] = 'Div_NE' THEN 'Div_NE'
WHEN [DivisionId] = 'Div_NW' THEN 'Div_NW'
WHEN [DivisionId] = 'Div_Other' THEN 'Div_Other'
WHEN [DivisionId] = 'Div_PkgAll' THEN 'Div_PkgAll'
WHEN [DivisionId] = 'Div_PNW' THEN 'Div_PNW'
WHEN [DivisionId] = 'Div_SE' THEN 'Div_SE'
WHEN [DivisionId] = 'Div_SW' THEN 'Div_SW'
WHEN [DivisionId] = 'Div_Taipak' THEN 'Div_Taipak'
WHEN [DivisionId] = 'Div_WP' THEN 'Div_WP'
WHEN [DivisionId] = 'International' THEN 'International'
WHEN [DivisionId] = 'Midwest' THEN 'Midwest'
WHEN [DivisionId] = 'MNA_Div' THEN 'MNA_Div'
WHEN [DivisionId] = 'Other' THEN 'Other'
WHEN [DivisionId] = 'PNW_Div' THEN 'PNW_Div'
WHEN [DivisionId] = 'Taipak_Div' THEN 'Taipak_Div'
WHEN [DivisionId] = 'Unknown' THEN 'Unknown'
WHEN [DivisionId] = 'West' THEN 'West'
WHEN [DivisionId] = 'Wine' THEN 'Wine'
END [SecurityDivisionID]
,[DivisionDescription]
,[CreatedDate]
,[CreatedBy]
,[UpdatedDate]
,[UpdatedBy]
,[SortOrder]
,[IsActive]
FROM [Invoicing].[dbo].[DimDivision]
ORDER BY [DivisionId]

8. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 8 of 9
Appendix D | Security Region ID
-- [Invoicing].[dbo].[DimRegion] with SecurityRegionID--
SELECT TOP (1000) [RegionKey] ,[RegionId]
,CASE
WHEN [RegionId] = 'Acedo' THEN 'Acedo'
WHEN [RegionId] = 'Binkowski' THEN 'Binkowski'
WHEN [RegionId] = 'Borras' THEN 'Borras'
WHEN [RegionId] = 'Bottene' THEN 'Bottene'
WHEN [RegionId] = 'Briggs' THEN 'Briggs'
WHEN [RegionId] = 'Caldwell' THEN 'Caldwell'
WHEN [RegionId] = 'Canada' THEN 'Canada'
WHEN [RegionId] = 'Danheiser' THEN 'Danheiser'
WHEN [RegionId] = 'Davis' THEN 'Davis'
WHEN [RegionId] = 'DuClos' THEN 'DuClos'
WHEN [RegionId] = 'Europe' THEN 'Europe'
WHEN [RegionId] = 'Forbes' THEN 'Forbes'
WHEN [RegionId] = 'Gibbs' THEN 'Gibbs'
WHEN [RegionId] = 'Kliska' THEN 'Kliska'
WHEN [RegionId] = 'Logue' THEN 'Logue'
WHEN [RegionId] = 'Mexico' THEN 'Mexico'
WHEN [RegionId] = 'MidAtlantic' THEN 'MidAtlantic'
WHEN [RegionId] = 'MidMountain' THEN 'MidMountain'
WHEN [RegionId] = 'MidSouth' THEN 'MidSouth'
WHEN [RegionId] = 'Midwest' THEN 'Midwest'
WHEN [RegionId] = 'Muster' THEN 'Muster'
WHEN [RegionId] = 'Northeast' THEN 'Northeast'
WHEN [RegionId] = 'Northwest' THEN 'Northwest'
WHEN [RegionId] = 'Other' THEN 'Other'
WHEN [RegionId] = 'OtherRegion' THEN 'OtherRegion'
WHEN [RegionId] = 'PkgDesign' THEN 'PkgDesign'
WHEN [RegionId] = 'POD' THEN 'POD'
WHEN [RegionId] = 'PODRegion' THEN 'PODRegion'
WHEN [RegionId] = 'SalesInit' THEN 'SalesInit'
WHEN [RegionId] = 'Simpson' THEN 'Simpson'
WHEN [RegionId] = 'Small' THEN 'Small'
WHEN [RegionId] = 'Southeast' THEN 'Southeast'
WHEN [RegionId] = 'Southwest' THEN 'Southwest'
WHEN [RegionId] = 'Taylor' THEN 'Taylor'
WHEN [RegionId] = 'Texas' THEN 'Texas'
WHEN [RegionId] = 'Unknown' THEN 'Unknown'
WHEN [RegionId] = 'WinePak' THEN 'WinePak'
WHEN [RegionId] = 'Taipak_Reg' THEN 'Taipak_Reg'
WHEN [RegionId] = 'MNA_Reg' THEN 'MNA_Reg'
WHEN [RegionId] = 'PNW_Reg' THEN 'PNW_Reg'
WHEN [RegionId] = 'San_Fran_Reg' THEN 'San_Fran_Reg'
WHEN [RegionId] = 'Reg_CE' THEN 'Reg_CE'
WHEN [RegionId] = 'Reg_EU' THEN 'Reg_EU'
WHEN [RegionId] = 'Reg_MME' THEN 'Reg_MME'
WHEN [RegionId] = 'Reg_MNA' THEN 'Reg_MNA'
WHEN [RegionId] = 'Reg_MS' THEN 'Reg_MS'
WHEN [RegionId] = 'Reg_MW' THEN 'Reg_MW'
WHEN [RegionId] = 'Reg_NE' THEN 'Reg_NE'
WHEN [RegionId] = 'Reg_Other' THEN 'Reg_Other'
WHEN [RegionId] = 'Reg_PNW' THEN 'Reg_PNW'
WHEN [RegionId] = 'Reg_POD' THEN 'Reg_POD'
WHEN [RegionId] = 'Reg_SE' THEN 'Reg_SE'
WHEN [RegionId] = 'Reg_SF' THEN 'Reg_SF'
WHEN [RegionId] = 'Reg_SW' THEN 'Reg_SW'
WHEN [RegionId] = 'Reg_Taipak' THEN 'Reg_Taipak'
WHEN [RegionId] = 'Reg_TX' THEN 'Reg_TX'
WHEN [RegionId] = 'Reg_CW' THEN 'Reg_CW'
WHEN [RegionId] = 'Reg_MX' THEN 'Reg_MX'
WHEN [RegionId] = 'Reg_WP' THEN 'Reg_WP'
WHEN [RegionId] = 'Reg_PkgAll' THEN 'Reg_PkgAll'
END [SecurityRegionID]
,[RegionDescription],[CreatedDate],[CreatedBy],[UpdatedDate],[UpdatedBy],[IsActive]
FROM [Invoicing].[dbo].[DimRegion]

9. Vision and Scope Document | SSAS Prototype, Row Level Security (RLS)
© AIM Business Driven Data Solutions, 2019 Page 9 of 9