Admin monitoring refresh failure

[Anonymous]

Hello,

The datasets in the new Admin monitoring workspace wont refresh anymore. Also it is not possible as an Power BI admin to get an Admin role for this workspace. So i can't check te dataset settings.

Error details:

Data source error: {"error":{"code":"ModelRefresh_ShortMessage_ProcessingError","pbi.error":{"code":"ModelRefresh_ShortMessage_ProcessingError","parameters":{},"details":[{"code":"Message","detail":{"type":1,"value":"The credentials provided for the AdminInsights source are invalid. (Source at AdminInsights.)"}}],"exceptionCulprit":1}}}
Cluster URI: WABI-WEST-EUROPE-B-PRIMARY-redirect.analysis.windows.net
Activity ID: 706ff8a3-0141-46d3-870f-5ac5c38258b7
Request ID: aaee75b8-262c-4e9e-87a6-158967a5a2d5
Time: 2023-05-28 09:42:21Z

[Leotwsystex]

This problem persists, and the cause is unknown. error message : Source fail : The credentials provided for the AdminInsights source are invalid. (Source at AdminInsights.). The exception was raised by the IDbCommand interface.

[ik_msf]

Are you the tenant admin? Is your admin role persistent, or does it use "just in time" or "privileged identity" to provision your admin role temporarily?

[Leotwsystex]

My account does not have Tenant Admin privileges, and I do not have sufficient permissions to view my specific role assignments or PIM (Privileged Identity Management) settings. However, I can confirm that the system was functioning correctly two weeks ago with my current setup.

[ik_msf]

The workspace uses the credentials of the tenant admin that first triggered the initialization/creation of the workspace (by navigating to Admin monitoring for the first time). If this user's admin role is not permanent, meaning they have a role assignment or PIM, and that assignment/PIM is not active during time of refresh, then the refresh will fail. This is a noted limitation of the feature, but I would check with your admin to confirm that this scenario matches their setup. It may be worth having your tenant admin reinitialize the workspace just in case there's not some other at play. However, note that while the first refresh after reinit may work because the admin's role is still active at that time, the problem will resurface the next time the models refresh without the user having an active admin role.

[Leotwsystex]

Thanks, @ik_msf, for the insights. Just to clarify—are you saying that once the Admin Monitoring workspace is initialized, the scheduled refresh will fail if the account used doesn't maintain permanent Tenant or Fabric Admin privileges? I’ve checked the workspace settings and noticed that the owner of the Admin Monitoring workspace cannot be manually changed. Since you mentioned that a reinitialization with a privileged account is necessary, do you happen to have any Microsoft documentation or a step-by-step guide on how to properly perform this reinitialization?

[Leotwsystex]

Thanks, @ik_msf, for the insights. Just to clarify—are you saying that once the Admin Monitoring workspace is initialized, the scheduled refresh will fail if the account used doesn't maintain permanent Tenant or Fabric Admin privileges? I’ve checked the workspace settings and noticed that the owner of the Admin Monitoring workspace cannot be manually changed. Since you mentioned that a reinitialization with a privileged account is necessary, do you happen to have any Microsoft documentation or a step-by-step guide on how to properly perform this reinitialization?

[Leotwsystex]

Thanks, @ik_msf, for the insights. Just to clarify—are you saying that once the Admin Monitoring workspace is initialized, the scheduled refresh will fail if the account used doesn't maintain permanent Tenant or Fabric Admin privileges? I’ve checked the workspace settings and noticed that the owner of the Admin Monitoring workspace cannot be manually changed. Since you mentioned that a reinitialization with a privileged account is necessary, do you happen to have any Microsoft documentation or a step-by-step guide on how to properly perform this reinitialization?

[ik_msf]

That's correct on your first note. There is a small caveat that we update the credentials (if they become inactive) with the credentials of any Fabric admin they next time they log into Fabric, however again - this may only valid for one refresh cycle if their role is also not persistent. Here are the instructions to reinit the workspace, there is an API that you can call (need to be an admin) to delete the workspace and reinitialize it. Let me know if you have any questions on it. https://learn.microsoft.com/en-us/fabric/admin/monitoring-workspace#reinitializing-the-workspace