Securing Your Cube Project - Getting Started with SQL Server 2012 Cube Development - page 222

Understanding security when a user belongs to
several roles
If a user belongs to two roles, Analysis Services security behaves a bit differently. In
other Microsoft products, least privilege wins. This means that if a role is denied the
access to an object and another role allows the access, the denial operation wins. In
Analysis Services, this is not true.
1. Test the security by selecting both the roles in the Change user dialog:
2. Run the following query:
SELECT [Measures].[Order Quantity] ON
COLUMNS,
[Sales Territory].[Sales Territory
Group].MEMBERS ON ROWS
FROM [Adventure Works DW2012]
3. You will get the following results: