Anonymous's avatar
Anonymous
Not applicable
4 years ago
Status:
Needs Info

bypassing MFA in PowerBI

I seem to have found a bug in PowerBI online. I am abe to bypass MFA for the service account, by logging in with my own account.

 

Steps I follow:

1.Go to www.powerbi.com in Google Chrome

The I choose the second account, which acts as a service-account and in the next screen I fill out the password

Then I get this screen:

 

Clicking on Volgende (Next) give me this:

 

But I cannot create this code because it's not in my authenticator app. So I click on Annuleren (Cancel). this brings me back to the screen where I can choose an account to log in:

Now I choose my own account and enter my password in the next screen. Then I get the MFA screen for logging in with my own account

 

I use my phone for the authentication and I get this screen:

after clicking on Gered (OK) I get on the powerbi site, but logged in with the service account.

 

It looks like everybody with a PowerBI account on our tenant can log in with the service account when they get hold of the password. Seems to me that is not how it should be

 

2 Comments

  • Anonymous's avatar
    Anonymous
    Not applicable

    Hi Anonymous 

    Please correct me if I wrongly understood your question .

    You sign in with service account and then return to the previous pane , then you sign in with your account and use your phone for the authentication . You ended up logging into Power BI Service under the service account ? What is the service account you mentioned ?

     

    Best Regards,
    Community Support Team _ Ailsa Tao

  • Anonymous's avatar
    Anonymous
    Not applicable

    The service account is the account in the screenshots that start with SA_AZ. This an account in the onmicrosoft.com domain. My personal account is an account in our own domain