Access to Data -authentication of data sources

[bco_lde]

Hi there

we are in the situation that our colleague that built the complete powerBI framework for us is leaving the company. 

to me it seems in all semantic models and dataflows, access to data sources is bound to his specific Entra User and his access rights to data. 

if we finally deactivate his accounts, all connections will then cease working. 

what is the best practice and recommended way to connect and authenticate to datasources to prvent this from happening in the future ? 
is a service user with all needed rights and switching data sources authetication to this user the best way ? 

there got to be a way to make it not dependant on an individual user account ? 
maybe an Application ID that is used ? 

thanks for the input, I really appreciate it. 

[tackytechtom · Accepted solution]

Hi @bco_lde ,

There are ways to use service principals for authenticating to your sources. For this matter, the semantic model owner can be set to a service principal.

Here blog post that shows a way to do this. It's a Powershell script being part of an Azure DevOps pipeline, but essentially you can run it from other clients as well. Depending on your data sources you need to fetch tokens with different Token URIs. Here an article, that tries to help you with that, too.

A challenge with this approach can be that you need to refresh that token for the service principal regularly. This is usually not a problem, if you orchestrate the refreshes of your semantic models from other tools, e.g. by using the refreshes REST API. All you need to do then is to fetch the appropriate token and assign it right before you call the API. I have seen different approaches for this, e.g. via Azure Data Factory or via Python scripts.

If your setup is based upon schedules in the Power BI service, however, you might actually run into the problem that the token has expired when the refresh is triggered.

By the way, in Fabric, I have seen options to pick service principals as an authentication method for certain data sources, but I am not sure whether you can do this in the Power BI Service (yet?).

Hope this helps 🙂

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/