Direct Query and SSO with Snowflake datasources

[Anonymous]

Hi

I'm interested in finding out more about the integration between Power BI and Snowflake using SSO and Direct Query.

I've read a few articles about how this works already and while to me, it seems ideal that all the access is controlled through direct query, as it doesn't seem to be spelt out (and I'm still learning how Power BI works), does using Direct Query with SSO automatically disable any user's ability to use "Import" over DirectQuery on those Snowflake datasets at any time in PowerBI? Just wanted to be sure there wasn't some way a user could enable "Import" for anything accessed with SSO. That would seem logical/ideal to me, but just wasn't sure from docs alone.

[Anonymous]

Hi @Anonymous ,

With SSO, you can have each user’s connection scoped down to their role instead of using the over-privileged role used with a service account. You can also track queries issued by each of these users in Snowflake.

First, you’ll need to ask your Power BI administrator to enable the “Snowflake SSO” option in the Power BI Admin portal.

Then, set up the security integration in Snowflake following the information in this doc. 

Next, create Power BI service business users who will be making direct queries into Snowflake. A good practice is to set up automated user synching between AAD or your IdP using System for Cross-domain Identity Management (SCIM). You can read more about SCIM here.

Now, instruct your report publishers to navigate to Workspace → dataset and select “Edit credentials” → OAuth from the “Authentication method” drop-down menu. Then instruct them to select the checkbox for “End users use their own OAuth2 credentials when accessing this data source via DirectQuery.”

For more details, you may refer to this blog.

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

Hey @Anonymous 

Thanks for the feedback and apologies if I've missed your comment against 'Import'as that's what I'm curious about atm - I'm across most of what you've described there from the doco (and yep we use SCIM for Azure AD to snowflake). 

What I'm not sure about yet (waiting for relevant team to open testing for PowerBI and snowflake) is is it possible to use "Import" with SSO set as for me it seems that Direct Query is more manageable re: privileges/access -  I just couldn't tell how flexible the choice (or even if there is one?) between DirectQuery and Import once SSO is setup between PowerBi and Snowflake? Hope that makes my question clearer?