I would be very grateful if someone could share their knowledge or experience with SharePoint Online + OLAP. Is it possible to configure Kerberos for Power BI for SharePoint?

What we have:

  1. On-premises SQL Server Analysys Services with a ready cube
  2. SSAS uses unique permissions based on AD users and groups
  3. We want to know if it's possible to work with this cube either in Excel Online or Power BI for SharePoint so that:

    • users can refresh data right in the browsers (using Excel online or Power BI)
    • user credentials are forwarded to the on-premises cube (using Kerberos or anything else)

I'm aware of the existance of Data Management Gateway, but I'm not sure if it's theoretically possible to forward users' permissions to the on-premises OLAP cube.

More background: We have recently setup Kerberos for SharePoint 2010 and Excel Services so that users can use data refresh based on their credentials and permissions. It works just fine, but our Customer has decided to move to SharePoint Online and wants "the same" solution moved there. I don't have enough argumets for or against this particular move.

1 Answer 1


Azure Active Directory (which is used by SharePoint Online) is not the same as On-Premises Active Directory. Azure Active Directory does not support LDAP, and is not using Kerberos. Instead, it uses Windows Identity Foundation for Authentication and the "Graph" API for LDAP type queries.

However, Azure does have some tools for syncing between Azure Active Directory and on-premises Active Directory (e.g. DirSync), so you may be able to give your users a single sign-on experience where they are using SharePoint Online and still be able to authenticate (and get authorization) to your SSAS using the same user account.

In this way, SSAS could still use its existing permissions, and SharePoint Online, with the same user accounts, would also be able to set permissions.

  • suppose, we did DirSync, which is the obvious step. We do get SSO when accessing SharePoint online website. No questions about that. Now, when we open a file in Excel Online or Power BI for SharePoint, how do user credentials get forwarded to the on-premises SSAS? We can't forward credentials even on-premises without Kerberos. Why having Azure Active Directory will magically work and forward credentials all the way back from Azure to on-premises SSAS in this case? Commented Apr 19, 2015 at 12:00
  • 1
    If the user is on-premises, they may have to login a second time when accessing SSAS (depending on Browser Settings, if they allow passwords to be saved, etc.) If user is off-premises, I don't know how to make that work. Commented Apr 20, 2015 at 23:13
  • 1
    Alternatively, you could make the On-Premises also authenticate with WIF. I personally, haven't done it, but here is a PluralSight course that likely explains how: pluralsight.com/courses/wif-patterns-premise-cloud Commented Apr 20, 2015 at 23:15
  • Greg, thank you for the hints, I've got a pluralsight subscription, so I'll have a look Commented Apr 21, 2015 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.