Forum Discussion
Analysis Server Roles from Entra workstation
We have Analysis Server solution, maintained and deployed from Visual Studio, where the roles defined use AD groups. This worked perfectly as long as long as the machine used was on the same domain as the groups or was hybrid joined. On a new laptop that is Entra-only joined we do see a curious issue. The AD where the groups are located is a fully trusted domain.
In SSMS (version 20.2) we now see this behavior in the Object Explorer:
- Connect to SQL Server Database Engine
- On-premise server A
- Navigate to Security -> Logins -> Right-click and select New Login
- Click on Search
- Click on Locations
- Full list of available domains to search is available
- Connect to SQL Analysis Services
- On-premise server A (so the same server)
- Navigate to Databases -> {Database name} -> Roles -> Right-click and select New Role
- Click on Membership and Add
- Click on Locations
- Only the local computer is available
This prevents us from creating new roles with an AD group membership. Please note that everything else is working fine. Browsing as another AD user in any way works perfectly.
Any ideas to why it behaves differently when connecting to database engine versus analysis services or what we can do to resolve this issue?
PS! We see similar issues in Visual Studio if we try to edit roles in a Analysis Services Project. The assumption is that these both rely on the same underlying services to lookup objects on the AD domain. Thus if we resolve the SMSS issue we hope that also resolves the VS AS project issue.
Regards, Stig
Hi StigJ ,
I ran into this before, it's because Entra-only machines can not browse AD groups in SSAS.
Quick fix: Just manually type the AD group (like DOMAIN\GroupName) when adding to the role, it works even if you can not browse.
Or, if you need the GUI to browse groups, best to use a domain joined or hybrid joined machine. Hope that helps!
2 Replies
- bandaruajeyuduCopper Contributor
Hi StigJ ,
I ran into this before, it's because Entra-only machines can not browse AD groups in SSAS.
Quick fix: Just manually type the AD group (like DOMAIN\GroupName) when adding to the role, it works even if you can not browse.
Or, if you need the GUI to browse groups, best to use a domain joined or hybrid joined machine. Hope that helps!
- StigJCopper Contributor
Hi,
many thanks for the reply. Good to get confirmed that it is not just us that have this issue. We did indeed end up by creating a hybrid joined machine to work around the issue. Not ideal, but....
Strange thing is that the quick fix do not work for us. And in Visual Studio Data Tools it will not even open the dialog window when clicking Add in Membership. But I guess that is another issue. We do have the workaround now.