Best practice to set up datasource authentications?

Heya,

From my personal experience, unless the informaiton is public stay away from system accounts (or organizational accounts or however companies want to name them - accounts shared by multiple users).

Top 3 messes I had to deal with:

- users who left the company and still had access to fresh confidential data one year after they left

- yearly audit failures because access and usage of the data could not be proven accordingly

- mistakes in handling data, accidentally deleting reports and datasets, ruining reports etc. (and then all the users using that priviledged account raising their shoulders saying "I don't know, it wasn't me, maybe someone else")

Even if it sounds tedious, design a solid access and privileges framework for the life-cycle of your users: control/limit/document who has access to what, who does what, and who is stand-in to whom (in case of vacations or unavailability). On top of it, make sure that deactivating the users is part of their exit list.

I had plenty of managers coming to me requesting implementation of these type of accounts for ease of operations and other bogus reasons and I always reminded them the 3 messes. If they could "live" with 2 and 3, having users still accesing the data after months of leaving the company was usually shutting them up.

Hope it helps.

Hi wolfgangkb-work ,

For import mode, I typically try to use service principals if the source is able to use one. 

I know in Fabric, you can actually specify a service principal in the connection at least for some data sources. In Power BI, I have used this approach down here, where a service principals takes over the semantic model and then is used for authenticating:

https://www.tackytech.blog/how-to-make-a-service-principal-the-owner-of-a-power-bi-dataset/

The blog article above uses a Powershell script, but I have also seen solutions in Python.

Let me know, if this helps 🙂

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/

Hi  , You can create a common account for your organisation and share its credential with whoever is working currently.
We generally follow this, as it wouldn't affect if the person leave.Did I answer your question? Mark my post as a solution! Appreciate your Kudos !!

Let's Connect on LinkedIn: https://www.linkedin.com/in/anmol-malviya/?originalSubdomain=in

wolfgangkb-work

Hi,

Thanks for the solutions MNedix , anmolmalviya05 and tackytechtom offered,and i want to offer some more information for user to refer to.

hello wolfgangkb-work , based on your descriotion, it is better that create a service-account with related license, if you want to create service account, you can refer to the following link about how to purchase it.

Sign up or purchase the Power BI service as an individual - Power BI | Microsoft Learn

Get licenses for users in your organization. - Power BI | Microsoft Learn

Best Regards!

Yolo Zhu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.