Forum Discussion

SantiagoG2310's avatar
SantiagoG2310
Regular Visitor
10 months ago
Solved

Connect Microsoft 365 Lighthouse Power BI

Hi,

I'm trying to connect M365 Lighthouse on PBI through connector published on Microsoft GitHub repo. I downloaded the package, set the app parameters in Microsoft Entra ID app registration and built the solution, but, when I try to login in Power BI select an account window, I get the error:

 

--- Get Data ---

--- Tenant Selection ---

--- Log In ---

 

*I have 'Global Reader' role permissions on my tenant.

 

Repo :

https://github.com/microsoft/microsoft365-lighthouse-bi

 

Thanks in advance for help.

  • v-achippa's avatar
    v-achippa
    9 months ago

    Hi SantiagoG2310,

     

    In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).

    • Set Supported account types to Multitenant and Grant admin consent.
    • Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
    • Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
    • Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.

    If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.

     

    Thanks and regards,

    Anjan Kumar Chippa

5 Replies

  • Aala_Ali's avatar
    Aala_Ali
    Most Valuable Professional

    You’re super close that sign-in failure is almost always one of four things:

    1. missing/incorrect redirect URI,
    2. app not set to multi-tenant (or consent not granted),
    3. incorrect Graph/Lighthouse permissions,
    4. Desktop not loading the custom connector properly.

    Here is quick fix-checklist :

    1. Enable custom connectors in Desktop
      • File → Options → SecurityData ExtensionsAllow any extension (not recommended).
      • Put the compiled .mez in:
        C:\Users\<you>\Documents\Power BI Desktop\Custom Connectors\
      • Restart Desktop.
    2. Use the correct redirect URI
    3. App registration settings (Authentication)
      • Supported account types: set to Accounts in any organizational directory (Multi-tenant).
      • If you created a Public client/SPA, make sure the redirect above is present under the right app type (don’t mix localhost redirects with the Power BI one).
    4. Permissions & consent
      • Lighthouse data flows through Microsoft Graph (Managed Tenants / Lighthouse). Ensure your app requests the minimal Graph scopes required by the connector (for example, the managed tenants endpoints).
      • After adding scopes, click Grant admin consent in the partner (MSP) tenant.
    5. Lighthouse prerequisites
      • Microsoft 365 Lighthouse is for CSP partners with delegated access (GDAP/DAP) to customer tenants. If that relationship isn’t in place, Graph/Lighthouse APIs won’t return data even if auth succeeds.
    6. Clear stale credentials
      • Power BI Desktop → FileOptions and settingsData source settings → clear permissions for the connector and sign in again.

    If this helps, please click Accept as Solution so others can find it, and I’d really appreciate your Kudos 🙌

    • SantiagoG2310's avatar
      SantiagoG2310
      Regular Visitor

      Hi Aala_Ali,

      Thank you for your response, excuse my lateness. I've verified and tried every step in your answer but the error persists. I share some code fragment of my connector and Azure app registration settings screenshots.

       

      Authentication:

      API permissions:

       

      Connector.pq

      GetAccessToken = (optional tenantId as text, optional scope as text) =>
          let 
              authResult = if (tenantId <> null) then 
                  TokenMethod("https://login.microsoftonline.com/" & tenantId & "/oauth2/v2.0/token", "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
              else
                  TokenMethod(token_uri, "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
          in 
              authResult[access_token];
      
      Logout = (token) => logout_uri;
      
      Refresh = (resourceUrl, refresh_token) => TokenMethod(token_uri, "refresh_token", "refresh_token", refresh_token);
      
      StartLogin = (resourceUrl, state, display) =>
          let
              authorizeUrl = authorize_uri & "?" & Uri.BuildQueryString([
                  client_id = client_id,  
                  redirect_uri = redirect_uri,
                  state = state,
                  scope = "offline_access openid profile https://graph.microsoft.com/.default",
                  response_type = "code",
                  response_mode = "query",
                  prompt = "select_account"
              ])
          in
              [
                  LoginUri = authorizeUrl,
                  CallbackUri = redirect_uri,
                  WindowHeight = 860,
                  WindowWidth = 1024,
                  Context = null
              ];
      
      TokenMethod = (tokenUri, grantType, tokenField, parameter, optional scope as text) =>
          let
              queryString = [
                  client_id = client_id,
                  scope = if (scope <> null) then scope else "offline_access https://graph.microsoft.com/.default",
                  grant_type = grantType,
                  redirect_uri = redirect_uri
              ],
              queryWithCode = Record.AddField(queryString, tokenField, parameter),
      
              tokenResponse = Web.Contents(tokenUri, [
                  Content = Text.ToBinary(Uri.BuildQueryString(queryWithCode)),
                  Headers = [
                      #"Content-type" = "application/x-www-form-urlencoded",
                      #"Accept" = "application/json"
                  ],
                  ManualStatusHandling = {400, 401, 403} 
              ]),
              body = Json.Document(tokenResponse),
              result = if (Record.HasFields(body, {"error", "error_description"})) then 
                          error Rest.GetError(body)
                       else
                          body
          in 
              result;

       

       

      • v-achippa's avatar
        v-achippa
        Community Support

        Hi SantiagoG2310,

         

        In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).

        • Set Supported account types to Multitenant and Grant admin consent.
        • Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
        • Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
        • Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.

        If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.

         

        Thanks and regards,

        Anjan Kumar Chippa

  • v-achippa's avatar
    v-achippa
    Community Support

    Hi SantiagoG2310,

     

    Thank you for reaching out to Microsoft Fabric Community.

     

    Thank you Aala_Ali for the prompt response. 

     

    As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the user for the issue worked? or let us know if you need any further assistance.

     

    Thanks and regards,

    Anjan Kumar Chippa

    • v-achippa's avatar
      v-achippa
      Community Support

      Hi @SantiagoG2310,

       

      We wanted to kindly follow up to check if the solution provided by the user for the issue worked? or let us know if you need any further assistance.

       

      Thanks and regards,

      Anjan Kumar Chippa