Forum Discussion
Connect Microsoft 365 Lighthouse Power BI
- 10 months ago
Hi SantiagoG2310,
In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).
- Set Supported account types to Multitenant and Grant admin consent.
- Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
- Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
- Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.
If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.
Thanks and regards,
Anjan Kumar Chippa
You’re super close that sign-in failure is almost always one of four things:
- missing/incorrect redirect URI,
- app not set to multi-tenant (or consent not granted),
- incorrect Graph/Lighthouse permissions,
- Desktop not loading the custom connector properly.
Here is quick fix-checklist :
- Enable custom connectors in Desktop
- File → Options → Security → Data Extensions → Allow any extension (not recommended).
- Put the compiled .mez in:
C:\Users\<you>\Documents\Power BI Desktop\Custom Connectors\ - Restart Desktop.
- Use the correct redirect URI
- In your Entra app registration, add this exact redirect:
https://oauth.powerbi.com/views/oauthredirect.html - This is the standard redirect required for Power BI custom connectors using OAuth.
- App registration settings (Authentication)
- Supported account types: set to Accounts in any organizational directory (Multi-tenant).
- If you created a Public client/SPA, make sure the redirect above is present under the right app type (don’t mix localhost redirects with the Power BI one).
- Permissions & consent
- Lighthouse data flows through Microsoft Graph (Managed Tenants / Lighthouse). Ensure your app requests the minimal Graph scopes required by the connector (for example, the managed tenants endpoints).
- After adding scopes, click Grant admin consent in the partner (MSP) tenant.
- Lighthouse prerequisites
- Microsoft 365 Lighthouse is for CSP partners with delegated access (GDAP/DAP) to customer tenants. If that relationship isn’t in place, Graph/Lighthouse APIs won’t return data even if auth succeeds.
- Clear stale credentials
- Power BI Desktop → File → Options and settings → Data source settings → clear permissions for the connector and sign in again.
If this helps, please click Accept as Solution so others can find it, and I’d really appreciate your Kudos 🙌
Hi Aala_Ali,
Thank you for your response, excuse my lateness. I've verified and tried every step in your answer but the error persists. I share some code fragment of my connector and Azure app registration settings screenshots.
Authentication:
API permissions:
Connector.pq
GetAccessToken = (optional tenantId as text, optional scope as text) =>
let
authResult = if (tenantId <> null) then
TokenMethod("https://login.microsoftonline.com/" & tenantId & "/oauth2/v2.0/token", "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
else
TokenMethod(token_uri, "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
in
authResult[access_token];
Logout = (token) => logout_uri;
Refresh = (resourceUrl, refresh_token) => TokenMethod(token_uri, "refresh_token", "refresh_token", refresh_token);
StartLogin = (resourceUrl, state, display) =>
let
authorizeUrl = authorize_uri & "?" & Uri.BuildQueryString([
client_id = client_id,
redirect_uri = redirect_uri,
state = state,
scope = "offline_access openid profile https://graph.microsoft.com/.default",
response_type = "code",
response_mode = "query",
prompt = "select_account"
])
in
[
LoginUri = authorizeUrl,
CallbackUri = redirect_uri,
WindowHeight = 860,
WindowWidth = 1024,
Context = null
];
TokenMethod = (tokenUri, grantType, tokenField, parameter, optional scope as text) =>
let
queryString = [
client_id = client_id,
scope = if (scope <> null) then scope else "offline_access https://graph.microsoft.com/.default",
grant_type = grantType,
redirect_uri = redirect_uri
],
queryWithCode = Record.AddField(queryString, tokenField, parameter),
tokenResponse = Web.Contents(tokenUri, [
Content = Text.ToBinary(Uri.BuildQueryString(queryWithCode)),
Headers = [
#"Content-type" = "application/x-www-form-urlencoded",
#"Accept" = "application/json"
],
ManualStatusHandling = {400, 401, 403}
]),
body = Json.Document(tokenResponse),
result = if (Record.HasFields(body, {"error", "error_description"})) then
error Rest.GetError(body)
else
body
in
result;
- v-achippa10 months ago
Community Support
Hi SantiagoG2310,
In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).
- Set Supported account types to Multitenant and Grant admin consent.
- Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
- Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
- Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.
If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.
Thanks and regards,
Anjan Kumar Chippa