title: Azure analysis service connection using Service principal not working
body: <p>I am trying to connect to Azure Analysis services using ADOMD and authenticated using a Service principal. So I have done following:</p>
  
  <ol>
  <li>Create app in AAD.</li>
  <li>Granted the app (Service principal) read permission on the Azure Analysis service.</li>
  </ol>
  
  <p>Below is my code to connect to Azure Analysis service.</p>
  
  <pre><code>            var clientId = "******";
              var clientSecret = "*****";
              var domain = "****.onmicrosoft.com";
              var ssasUrl = "northeurope.asazure.windows.net";
              var token = await TokenHelper.GetAppOnlyAccessToken(domain, $"https://{ssasUrl}", clientId, clientSecret);
  
              var connectionString = $"Provider=MSOLAP;Data Source=asazure://{ssasUrl}/{modelname};Initial Catalog= adventureworks;User ID=;Password={token};Persist Security Info=True;Impersonation Level=Impersonate";
              var ssasConnection = new AdomdConnection(connectionString);
              ssasConnection.Open();
              var query = @"Evaluate TOPN(10,Customer,Customer[Customer Id],1)";
              var cmd = new AdomdCommand(query)
              {
                  Connection = ssasConnection
              };
              using (var reader = cmd.ExecuteXmlReader())
              {
                  string value = reader.ReadOuterXml();
                  Console.WriteLine(value);
              }
  </code></pre>
  
  <p>I am able to get a valid access token, but I get following error when trying to open the connection:</p>
  
  <p><strong>AdomdErrorResponseException: Either the user, 'app:xxxxxxx@xxxxxx', does not have access to the 'adventureworks' database, or the database does not exist.</strong></p>
  
  <p><strong>Additional info:</strong> : </p>
  
  <ol>
  <li>I have verified that permissions (Reader &amp; also tried with contribute) are given to Service principal to Azure analysis Service thru the Azure portal.</li>
  <li>I have tried same code with service account (username &amp; password) and it works.</li>
  <li>If I remove "Initial Catalog= adventureworks" from the connection string then my connection will succeed. But I do not see why Analysis services permission is not propagated to the model.</li>
  </ol>
  
  <p><strong>Resolution:</strong></p>
  
  <p>Silly that I got the resolution by myself just after posting this. The point no 3 above gave me a clue.Granting permission on the Azure analysis services through the portal does not propagate to the model for the Service principals (Azuire AD apps).</p>
  
  <p>Steps:</p>
  
  <ol>
  <li>Open the Azure analysis service in Sql server Mgmt Studio.</li>
  <li>In the target model, go to <strong>Roles</strong>.</li>
  <li><p>Add the service principal into required role with permission. Service principal is added in below format:</p>
  
  <p>app:[appid]@[tenantid] </p></li>
  </ol>
  
  <p>example : app:8249E22B-CFF9-440C-AF27-60064A5743CE@86F119BE-D703-49E2-8B5F-72392615BB97</p>