Forum Discussion

mzimb's avatar
mzimb
New Member
21 days ago
Solved

Authenticate Google Users

I have a Power BI Reporting server that is currently connected to Active Directory.  All of the report users also authenticate with Active Directory.  This PBRS server is my last AD joined server.  I would like to make it a standalone server and then have my report users get authenticated with their google (G-Suite) account.  Is this possible?  Most discussions I have found on this are at least 5 years old.  I am hoping there has been some progress in this direction.  Any help will be appreciated.

  • Hi mzimb​,

    tayloramy​ is right that Power BI Report Server does not have a built-in Google Workspace authentication provider, but there is one additional option worth mentioning.

    PBIRS supports custom authentication/security extensions, so it is possible in principle to replace the normal Windows authentication flow with a custom identity implementation.

    Microsoft also provides a Custom Security Sample specifically for Power BI Report Server.

    So the distinction is:

    • Native "Sign in with Google" support: No
    • Authenticate through Google using a custom PBIRS security extension: Technically possible, but requires custom development.


    You would need to implement the Google OAuth/OIDC sign-in flow and map the authenticated Google identity to the user identity that PBIRS uses for authorization.

    There are a few important side effects to test before removing the server from AD. For example, Microsoft documents that Power BI Desktop cannot save directly to a PBIRS instance using custom security, so PBIX files need to be uploaded through the portal. Any reports that currently depend on Windows Integrated authentication/Kerberos for their data sources would also need to be reviewed separately.

    For RLS, PBIRS can use the username supplied by the custom authentication implementation, as described in the Report Server RLS documentation.

    So I would treat Google authentication as a custom-security-extension project rather than an AD configuration change, and validate it in a separate PBIRS environment before removing the existing domain dependency.

    AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.

4 Replies

  • Hi mzimb​,

    To my knowledge, there is no way to integrate Report Server with Google Workspace. It is built around Microsoft's Active Directory.

    You might be able to do an AD sync between your Microsoft tenant and Google Workspace to get Google identities in Entra, and then sync Entra to your local AD, but I've not tried this and it honestly sounds like an SSO nightmare to implement and maintain. 

     

  • v-sathmakuri's avatar
    v-sathmakuri
    Icon for Community Support rankCommunity Support

    Hi mzimb​ ,

    Thank you for reaching out to fabric community.

    Could you review the suggestion provided above and let us know if you have any additional questions, we are happy to address. 

    Thanks!!

  • Hi mzimb​,

    tayloramy​ is right that Power BI Report Server does not have a built-in Google Workspace authentication provider, but there is one additional option worth mentioning.

    PBIRS supports custom authentication/security extensions, so it is possible in principle to replace the normal Windows authentication flow with a custom identity implementation.

    Microsoft also provides a Custom Security Sample specifically for Power BI Report Server.

    So the distinction is:

    • Native "Sign in with Google" support: No
    • Authenticate through Google using a custom PBIRS security extension: Technically possible, but requires custom development.


    You would need to implement the Google OAuth/OIDC sign-in flow and map the authenticated Google identity to the user identity that PBIRS uses for authorization.

    There are a few important side effects to test before removing the server from AD. For example, Microsoft documents that Power BI Desktop cannot save directly to a PBIRS instance using custom security, so PBIX files need to be uploaded through the portal. Any reports that currently depend on Windows Integrated authentication/Kerberos for their data sources would also need to be reviewed separately.

    For RLS, PBIRS can use the username supplied by the custom authentication implementation, as described in the Report Server RLS documentation.

    So I would treat Google authentication as a custom-security-extension project rather than an AD configuration change, and validate it in a separate PBIRS environment before removing the existing domain dependency.

    AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.

  • v-sathmakuri's avatar
    v-sathmakuri
    Icon for Community Support rankCommunity Support

    Hi mzimb​ ,

    Could you review the suggestion provided above and let us know if you have any additional questions, we are happy to address. 

    Thanks!!