Set Log Analytics Workspace Credentials with SP and PowerBi API

[stefanik]

Hi all,

i'm trying to set Anonymous access credentials for a Log Analytics Workspace gateway throught PowerBi API with a Service principal:

1) it is possible? I mean, i'm able to set it for Application insights or Sql Server credentials, but for Log Analytics no. I receive (from postman) an Unouthorized

this is the value for the API body:

{

  "credentialDetails": {

    "credentialType": "Anonymous",

    "credentials": "{\"credentialData\":\"\"}",

    "encryptedConnection": "Encrypted",

    "encryptionAlgorithm": "None",

    "privacyLevel": "Organizational"

  }

}

and this is the error:

{
"error": {
"code": "DM_GWPipeline_Gateway_InvalidConnectionCredentials",
"pbi.error": {
"code": "DM_GWPipeline_Gateway_InvalidConnectionCredentials",
"parameters": {},
"details": [
{
"code": "DM_ErrorDetailNameCode_UnderlyingErrorCode",
"detail": {
"type": 1,
"value": "-2147467259"
}
},
{
"code": "DM_ErrorDetailNameCode_UnderlyingErrorMessage",
"detail": {
"type": 1,
"value": "The credentials provided for the Web source are invalid. (Source at https://api.loganalytics.io/v1/workspaces/*********/query.)"
}
},
{
"code": "DM_ErrorDetailNameCode_UnderlyingHResult",
"detail": {
"type": 1,
"value": "-2147467259"
}
},
{
"code": "Microsoft.Data.Mashup.CredentialError.DataSourceKind",
"detail": {
"type": 1,
"value": "Web"
}
},
{
"code": "Microsoft.Data.Mashup.CredentialError.DataSourcePath",
"detail": {
"type": 1,
"value": "https://api.loganalytics.io/v1/workspaces/*********/query"
}
},
{
"code": "Microsoft.Data.Mashup.CredentialError.Reason",
"detail": {
"type": 1,
"value": "AccessUnauthorized"
}
},
{
"code": "Microsoft.Data.Mashup.MashupSecurityException.DataSources",
"detail": {
"type": 1,
"value": "[{\"kind\":\"Web\",\"path\":\"https://api.loganalytics.io/v1/workspaces/*********/query\"}]"
}
},
{
"code": "Microsoft.Data.Mashup.MashupSecurityException.Reason",
"detail": {
"type": 1,
"value": "AccessUnauthorized"
}
}
],
"exceptionCulprit": 1
}
}
}

2) Needs the SP some specific grants against the workspace? I mean, actually it is the contributor of the workspace and i'm able to use it to publish the dataset to the service and for fill it with others types of credentials. The SP and Log Analytics Ws are in differnt subscriptions.

Actually i have only one table in the Pbix. In the table power query i ask for a token and call the Log Analytic Ws with the returned token.

In PowerBi Desktop sources i can see the token endpoint and the Log Analytic Ws endpoint (the same if i ask for gateways throught API with postman).

From PowerBi Desktop i'm able to set Anonymous access for the two, and all works well.

Thx

Stefanik

[stefanik · Accepted solution]

I've created a Microsoft ticket for this "problem".

They said, at the moment, it is not possible and suggested me this workaround:

https://urlsand.esvalabs.com/?u=https%3A%2F%2Fblog.kloud.com.au%2F2018%2F07%2F23%2Fuse-anonymous-aut...

I've submitted a request in PowerBi Idea:

https://ideas.powerbi.com/ideas/idea/?ideaid=d3891d93-33c4-eb11-ba5e-281878bdaa58

Thx all

[stefanik]

I tink the problem could be solved if there is a way to programmatically set "Skip test connection".

Is there any way through PowerBi API?

[V-lianl-msft]

You need to leave as optional the cloud source and not add it to the gateway in order for the refresh to work.

Please refer to:

https://docs.microsoft.com/en-us/power-bi/connect-data/service-gateway-mashup-on-premises-cloud 

https://docs.microsoft.com/en-us/power-bi/connect-data/refresh-desktop-file-onedrive 

[stefanik]

Hi

thanks for your response. Sorry, I've read all docs but I think i missed the point.

All of my Pbix are in PowerBi Service. No physical gateways present.

What do you mean with " ... leave as optional the cloud source ... " ?

I have five Pbix that i customize (their name, connection strings, apikey .... specific for each of our customer) before publishing them to the service with powerbi api. This way, with five "templates", i can publish an update to all customers (more or less 40, so 200 pbix) with a CI/CD pipeline.

I don't have to sync my local copy with the cloud one because there is no match between the two (the published one is the customization of the local copy made by the pipeline)