Forum Discussion
Authentication Method for Refreshing Power BI Dataset (Azure SQL Source)
Hi kankamon ,
Apologies for the late reply.
I have included the troubleshooting learning document and the previously resolved thread. This may help you to resolve the issue.Troubleshoot scheduled refresh for Azure SQL databases - Power BI | Microsoft Learn
Solved: SQL Azure Import Data Refresh - Microsoft Fabric Community
If this post helped resolve your issue, please consider the Accepted Solution. This not only acknowledges the support provided but also helps other community members find relevant solutions more easily.
We appreciate your engagement and thank you for being an active part of the community.
Best regards,
LakshmiNarayana.Hey kankamon ,
To use the certificate for your Service Principal in Power BI, follow these steps:
Upload the Certificate in Azure AD:
Go to Azure AD > App Registrations > Your Service Principal > Certificates & Secrets.
Upload your certificate there.
Configure Power BI:
In Power BI Service, go to Settings > Datasets > Data source credentials.
Choose Service Principal (App-only authentication).
Instead of using a client secret, Power BI will now use the certificate you uploaded in Azure AD.
Basically, the certificate is linked to the Service Principal in Azure AD, and Power BI will use it for authentication during the refresh.
For Detailed Information:
Create a Service Principal in Azure AD
Configure certificates for Azure AD App Registration
Configure Service Principal authentication for Power BI
Power BI Data Source Credentials Documentation
If you found this solution helpful, please consider accepting it and giving it a kudos (Like) it’s greatly appreciated and helps others find the solution more easily.
Best Regards,
Nasif Azam
Super UserHi kankamon
Given your scenario—where the dataset connects to Azure SQL using Microsoft Entra ID in Power BI Desktop, but whitelisting Power BI IP addresses for OAuth2 isn't feasible and using a Service Principal raises concerns due to the key rotation—you’re encountering a common challenge in enterprise environments. The most sustainable and secure approach would be to use Managed Identity for authentication. Managed Identity is supported when your Power BI workspace is hosted on Fabric Capacity (F64, for instance), and it avoids the need to manage secrets or rotate keys. It authenticates the Power BI service itself directly with Azure SQL using Entra ID, and the identity is managed by Microsoft, so there's no client secret involved. To use this, you need to enable Managed Identity in the workspace settings, and then grant that Managed Identity the necessary roles (e.g., db_datareader) in your Azure SQL database. This approach is secure, supports automated refreshes, and removes the burden of IP whitelisting or key expiration. If you're not on Fabric or Premium capacity, however, then rotating a Service Principal key using tools like Azure Key Vault and scripting regular updates may be your fallback—though less ideal. Managed Identity is the recommended best practice when available.