How to create a SSAS 2008 cube that admins can't view data of

Question

I'm working on a compensation cube for our FP&A team.  They are currently feeding me dummy data until the cube is finalized.  What will be the simplest way to allow that team access to the cube while preventing myself and other admins from being able to view the data once they start feeding it live data?  They would need the ability to process it on demand as well.

Answer 1

You'll need to provide the users who belong to the FP&A team admin access and remove yourself and other unwanted members with admin access.

Also, you might want to turn the BuiltinAdminsAreServerAdmins property off. See this  - http://shahfaisalmuhammed.blogspot.com/2011/09/builtinadminsareserveradmins-property.html

---

Shahfaisal Muhammed http://shahfaisalmuhammed.blogspot.com

Answer 2

We have other cubes that are on this SSAS instance where we (the BI team) need to remain admins.  We can go a virtual server route if needed but were hoping to avoid that.

Answer 3

I would still turn this property off and add the BI team as admins to other cubes. Hope this helps.

---

Shahfaisal Muhammed http://shahfaisalmuhammed.blogspot.com

Answer 4

debn802,

To accomplish this in one SSAS instance, you may need to follow Shahfaisal's advice on this.

Would you consider installing a second instance of SSAS (on the same server) just to host this highly sensitive data?  This way you can allow admins to maintain the same broad authority they do of the databases in the first instance as they do now, and lock the second instance down so only the FP&A users are admins.  It may be the best way to have auditable administrative access without disrupting the current DBA process.

FWIW,
Rob

---

Rob Kerr SQL Server MVP CTO, BlueGranite

Answer 5

thanks all...it sounds like a separate instance will be my only way to go.  i'll pose some questions to our dba's to see what they want to support.  Thanks!!