Ideally I’d like them to implement the EffectiveUserName=XXX; argument to the SSAS connection string but I suspect they have no real incentive to since forcing users onto Tableau extract (their own columnstore) makes better business sense for them.

Great feedback! Yes, you’ll “loose” SSAS features to matter what self-service BI tool you use. About security, couldn’t you flow the user identity by configuring the Tableau server connection to prompt the user? It’s a pity that their Windows integrated security is not really “integrated”.

Yes, my experience confirms that data analysts want to have access to raw data. And, as you pointed out, this involves a whole new set of challenges, including data governance, security, etc.

The real challenge is educating the users what tasks can be completed by connecting to the semantic layer (the most rapid form of BI) and which ones require self-serviced BI models, such as mashing up DW data with external data.

* Calculated fields
* Custom hierarchies
* Custom groups
* Bins
* Time intelligence is not compatible with cube date dimensions
* Forecasts

Also, once you publish workbooks to Tableau server there is no way to flow the user identity back to Analysis Services effectively disabling any cube security you might have.

The whole point of Tableau is to allow rapid creation and iteration of business intelligence by business users. We have found that it is not possible without a lot of IT involvement when using cubes.

The solution? Give Tableau users access to the SQL views you use to populate the Analysis Services cube.

The downside to this is now you have to maintain two semantic models, two sets of security etc. but it is the only way.