When roles are assigned for cubes the user has access or no access to the cube. When roles are assigned to a dimension, the user gains only partial access to parts of the cube. The simplest method of restricting access to a dimension is to prevent access to all levels except the top level of the dimension. In the Cube role dialog box all users were given complete access to the sales cube. Let us restrict the access of users by permitting them to see only values broken out by fiscal years.

In the console tree right click the sales cube and click Manage roles. The cube role manager displays all the roles in the database with a check mark against the roles that apply to this cube.

Select All users role and click the ellipsis button in the restricted Dimensions column

The Edit a cube role dialog box appears. It shows all the dimensions in the cube. The default role is unrestricted. Click on Time and note that a drop down box appears in the Role column. Click on the drop down and select Restricted.

The dimension access can be set to fully restricted, unrestricted or custom. Let us click fully restricted and click Ok to change the dimension rule. Note that the restriction is displayed in the cube role manager dialog box.

If the user is logged in the role he can browse the data by clicking test role button. The time dimension continues to be available. Restricted access does not remove the dimension. If the user clicks on the drop down list of the dimension he will note that only the All time level is available. Restriction has effectively removed all other levels of the dimension, except the top level.

Users can be restricted from viewing certain members of a dimension. Click on the Product dimension in the Dimensions tab of the Cube role Editor. Click on the drop down list in the Rule column and select Custom.

Next Page: Tutorial 66: MSAS - Applying security to a Dimension - Page 2