Managed indentity and Power BI

[boble]

Hello,

We aim to ensure our reports are not user-dependent. That's why we're interested in using a managed identity to manage the connections to our data sources. However, we're struggling to find information on this topic. Is this a common challenge?

[tackytechtom]

Hi @boble ,

I interpret your query that you want to use Power BI's "managed identity" to login to your data sources in order to fetch the data from there. However, Power BI does not have its own managed identity. You could use Service Principals instead, though. For this, the Service Principal needs to take over / own the semantic model. Here a blog about this topic. It utilises an Azure DevOps Pipeline to do the job as part of an CICD process for an Azure SQL Database. But in the end it is just a PowerShell script that you can also run from other clients. 

Let me know, if this helps 🙂

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/

[TU186002]

Tom,

I'd be interested in reading more about your solution on your blog (great blog by the way).  Which one is it?  I thought it might be https://www.tackytech.blog/how-to-refresh-power-bi-datasets-from-data-factory-with-managed-identity/

but I wasn't sure.

Thanks

Tim

[tackytechtom]

Hi @TU186002 ,

It depends a little on what you wanna be doing. The article you are referring to uses Data Factory's Managed Identity to refresh a semantic model in Power BI. 

The query in this thread here, however, was about using some kind of Managed Identity that authenticates from Power BI into data sources. Since Power BI does not have a Managed Identity, you need to use Service Principals. For this, you can programmatically assign a Service Principal to take over the semantic model and then use its credentials for authentication (e.g. via an access token). 

I have seen in Fabric, that you can directly add a Service Principal and its secret without taking over the semantic model. I am not sure, whether this works out-of-the-box in Power BI already.

Here, the article that shows how to set a service principal as a semantic model owner:
https://www.tackytech.blog/how-to-make-a-service-principal-the-owner-of-a-power-bi-dataset/

Hope this helps! 

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/

[boble]

Hi,

Thank you for the link. It was very informative. I see at the end of the article that there is an issue with the token expiration. How did you solve this?

[tackytechtom · Accepted solution]

Hi @boble ,

The idea is to refresh the token right before a semantic model refresh is triggered from the refreshes REST API.  It's almost like a Just-In-Time access control approach: Anytime you want to fetch data from your sources, grab an access token from Entra ID (former Azure Active Directory) and use it for authentication. Then trigger a semantic model refresh via the REST API to get the data into Power BI. If you are already using the refreshes API to trigger a refresh (from a Data Factory, PowerShell, Python Script etc.) you would just need to add that part of fetching a token and updating the semantic model credentials before.

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/