For on-premises SSAS models that Power BI users will access via Live connections, an SSAS data source must be added in the Manage gateways portal. Critically, the credentials entered for this data source in the Manage gateways portal must match an account that has server administrator permissions for the SSAS instance. The following image, from SQL Server Management Studio (SSMS), exposes the server administrator accounts for the ATLAS instance of SSAS Tabular: 

Both SSAS and Azure Analysis Services instances can be accessed via SSMS. Additionally, the Analysis Server Properties dialog from the preceding image can be accessed by right-clicking the instance name. Identification of the Power BI user by SSAS will only work if a server admin account is specified and thus used when opening connections.

User authentication to SSAS is based on the EffectiveUserName property of SSAS. Specifically, the user principal name (for example, [email protected]) of the Power BI user is passed into this property and this email address must match a UPN within the local Active Directory. This allows the SSAS model to apply any row-level security roles built into the model for the given Power BI user.