Amending Azure Analysis Services Database Roles in DevOps

Question

I'm trying to configure a CI/CD pipeline in Azure DevOps for Azure Analysis Services database deployments.

Deploying the Model.bim file is simple enough, using the 'Azure Analysis Service Deployment' task available already.

However, the AD groups assigned to roles within the AAS database change depending on whether the deployment is to say Test or Production. I was looking to run some kind of PowerShell to achieve this, however hours of searching for this specific scenario have not borne fruit. The current Az.AnalysisServices does not appear to beyond the actual server in its scope:

https://docs.microsoft.com/en-us/powershell/module/az.analysisservices/?view=azps-3.1.0

There is a reference in the above document to using the standard SQL Powershell commands, however this doesn't really have any example scripts in it for AAS, or even any cloud-based solution.

I wonder if anyone has had any success doing this? I am open to connecting to a VM and running scripts on there if needed, but a fully cloud-based solution is preferred.

TMSL solutions also welcome.

Answer 1

For posterity, I used Invoke-ASCmd and a createOrReplace statement and this achieved what I needed to do.

This involves creating credentials to connect (I was using a service account), creating a parameter that contains the createOrReplace statement and then executing it against AAS:

$password = ConvertTo-SecureString “<password>” -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential (“<user>@<domain>”, $password)

Connect-AzAccount -Credential $Cred

$TMSLCommand = @"

{
  "createOrReplace": {
    "object": {
      "database": "<AAS Database>",
      "role": "Read"
    },
    "role": {
      "name": "Read",
      "modelPermission": "read",
      "members": [
        {
          "memberName": "<ad group object id/user>@<tenant id/domain>",
          "identityProvider": "AzureAD"
        }
      ]
    }
  }
}


"@    

Invoke-ASCmd -Server "<AAS Server Name>" -Database "<AAS Database>" -Query $TMSLCommand -Credential $Cred;