Analysis Services Security - SQL Server Analysis Services 2012 Cube Development - page 251

How it works...
At this point, you should have some questions regarding the various options that
you saw while configuring a simplistic security role. You noticed that you could have
chosen Select all members or Deselect all members prior to choosing which
product categories to make available for the role. It's only natural to wonder what
the difference between these two options is. If you choose Deselect all members
first and check only the needed members, the checked members will be included in
the allowed member set on the Advanced tab. Had you instead chosen Select all
members and subsequently unchecked the members you did not want to expose,
the unchecked member list would be shown in the denied member set. This does not