Authenticate Semantic Model against Azure SQL Server using Workspace Identity

Hi JakeHRogers 

No, Workspace Identity cannot currently authenticate against Azure SQL databases directly.

As of now, Workspace Identity authentication in Power BI only supports:

• Databricks (SQL & Lakehouse)

• Azure Data Lake Storage Gen2

• Fabric Lakehouses (internal)

Some Microsoft-hosted services like OneLake or Office365 scenarios

Why It Doesn't Work for Azure SQL:

• Azure SQL requires either:

  • SQL Authentication (username/password)

  • Azure Active Directory (AAD) authentication, usually via OAuth2 (i.e., user or service principal).

When you try to set up OAuth2 in the Power BI Service for Azure SQL, it expects a user identity or a service principal, not the Workspace Identity.

What You Can Do Instead:

1. Use a Service Principal (App Registration):

   • Register an Azure AD application.

   • Assign it to the Azure SQL database as an AAD user.

   • Grant it appropriate permissions.

   • In Power BI, use OAuth2 + Organizational account, and sign in using the Service Principal (with client ID/secret).

2. Or use Managed Identity via Dataflow Gen2 (Fabric):

   • If you're working in Fabric and your model is built off a Dataflow Gen2 or Lakehouse, Workspace Identity can help upstream.

But you cannot directly connect your semantic model to Azure SQL via Workspace Identity at this time.

Did I answer your question? Mark my post as a solution! Appreciate your Kudos !!

Hi JakeHRogers ,

Thank you for reaching out to the Microsoft Community Forum.

In addition to johnbasha33 , I am adding some more points.

1.Microsoft does support authenticating semantic models (datasets) using Managed Identities, including Workspace Identity, but this is currently only available in Premium or Fabric capacities, not in Pro workspaces.

2.In your case, since you're using a Pro workspace, this feature is not yet supported. That’s why you’re only seeing the OAuth2 option, which requires a user principal (email address) and not a managed identity.

Note: OAuth2 with email: This method uses delegated user credentials and is the default for Pro workspaces.
Workspace Managed Identity: This is a system-assigned identity tied to the workspace. It can be used to authenticate to Azure SQL Server, but only in Premium/Fabric workspaces where the feature is enabled.

3.Power BI supports Managed Identity authentication (Workspace Identity) for Azure SQL Database and Azure SQL Managed Instance, but only when the workspace is hosted in a Power BI Premium or Premium Per User (PPU) capacity.

Note: The Workspace Managed Identity is granted access to the Azure SQL database (as an AAD user).

Please refer Microsoft articles and blogs.

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

Support for Workspace Identity Authentication and Trusted Access to ADLS Gen2 in Semantic Models | Microsoft Fabric Blog | Microsoft Fabric

Introducing Workspace Identity Authentication for OneLake Shortcuts and Data Pipelines  | Microsoft Fabric Blog | Microsoft Fabric

Securing Microsoft Fabric: Best Practices for User Authentication & Authorization

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you