You are designing a SQL Server Analysis Services (SSAS) cube. You need to implement custom security. The cube contains a Product dimension. Users are part of either the Sales, Marketing, or Product Ma

Creating three distinct roles allows Sales, Marketing, and Product Manager users to each have independent security definitions, preventing permission conflicts between groups. Dimension data security in SSAS uses MDX-based allowed member sets to filter which dimension members (Bikes, Clothing, or all products) are visible to members of each role. This combination directly satisfies the requirement for multiple security groups with separate category-level visibility rules.

A single role cannot independently restrict different users to different product categories because all members of one role share the same permission set.

Attribute security controls access to dimension attributes and hierarchies themselves, not the specific member values within a category such as Bikes or Clothing.

One role with attribute security neither separates permissions by user group nor filters dimension members by category value, failing both requirements.