Azure Blob connection issue

[RyanHare92]

I previously made a post about this and I thought I had resolved the issue... Turns out I haven't.

This is driving me mad and I am desperate for a solution.

I have set up a connection to a container in Azure using the following:

I successfully managed to connect using the SAS key for the container that I have and I can view all the contents. I do not have access to the main domain.

When I look in the data source setting, the main domain is appearing even though when I press on change source, it actually shows the URL for the container I am conecting to: 

My problem is that when I publish the report and try to put in the credentials for the container, it won't accept it, as it appearently wants the credentials for the main domain:

I feel like I have tried everything but I can't find a solution to this! 

[freginier]

This is the classic "container SAS vs account-level auth" mismatch. AzureStorage.Blobs() authenticates at the storage account level (the root ...blob.core.windows.net domain), not at the individual container. That's why the main domain shows up in Data source settings even though your M query points at the container, and why the published credential prompt asks for the account: your SAS is scoped to the container only, so it can't satisfy the account-level credential and you get "credentials are invalid".

A few ways out:

1) Put the SAS in the URL and read it as Anonymous, so there is no account-level credential to satisfy. Instead of AzureStorage.Blobs, append the SAS token as a query string and use Web.Contents, e.g. Web.Contents("https://asrcareports.blob.core.windows.net/esmcr939?<sas-token>"), then set the credential for that URL to Anonymous. (You lose the nice navigator, but it authenticates against the container only.)

2) Fix the credential entry. In File > Options and settings > Data source settings, select the https://asrcareports.blob.core.windows.net entry, Clear permissions, then reconnect and choose the SAS / account key option. With only a container-scoped SAS, option 1 is the more reliable route.

3) Easiest if you can get it: ask for an account-scoped SAS, the storage account key, or Azure AD RBAC ("Storage Blob Data Reader") on the account. Any of those satisfy the account-level auth and the container just works, including on the Service after publishing.

In short, the root-domain prompt isn't a bug, it's Power BI authenticating at the account level. Either give it an account-level credential, or bypass the binding by carrying the container SAS in the URL with Web.Contents.