Forum Discussion

Bodyes's avatar
Bodyes
Regular Visitor
11 months ago
Solved

Authentication to Sharepoint via Workspace Identity

Hi We have an issue with connection to our SharePoint site to get data from it to our PowerBi. We have created a PowerBI workspace and we want to use Workspace Identity as an authentication method ...
Need Help
  • tayloramy's avatar
    tayloramy
    11 months ago

    Hi Bodyes,

     

    Today, those SharePoint connectors don’t support Workspace identity, so the Service can’t acquire a token with that auth type and you get “The credentials provided for the SharePoint source are invalid.”

    Quick solution
    1) Don’t use Workspace identity for SharePoint (for now). Use a Service Principal (“app-only”) or a standard Organizational account.
    2) You do not need Premium just to refresh a dataset that reads SharePoint with a Service Principal. Pro is fine.
    3) If you choose Service Principal, grant it “Sites.Selected” on both Microsoft Graph and SharePoint, and then explicitly grant the app access to the specific site. Finally, set dataset credentials in the Service to OAuth2 > Service principal.

     

    If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

tayloramy's avatar
tayloramy
Icon for Super User rankSuper User
11 months ago

Hi Bodyes,

 

Today, those SharePoint connectors don’t support Workspace identity, so the Service can’t acquire a token with that auth type and you get “The credentials provided for the SharePoint source are invalid.”

Quick solution
1) Don’t use Workspace identity for SharePoint (for now). Use a Service Principal (“app-only”) or a standard Organizational account.
2) You do not need Premium just to refresh a dataset that reads SharePoint with a Service Principal. Pro is fine.
3) If you choose Service Principal, grant it “Sites.Selected” on both Microsoft Graph and SharePoint, and then explicitly grant the app access to the specific site. Finally, set dataset credentials in the Service to OAuth2 > Service principal.

 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

  • Bodyes's avatar
    Bodyes
    Regular Visitor
    11 months ago

    Hi tayloramy,

    Thanks a lot for your suggestions, to be honest I was sure that I can use Workspace Identity for authentication

    I'll later that day try your idea but I will mark it as solution now

    Once more, thanks a lot! 

  • Bodyes's avatar
    Bodyes
    Regular Visitor
    10 months ago

    Hi tayloramy,

    I tried to authenticate to SharePoint via new Service Principal method but unfortunately I recieved the same error which I got with Workspace identity "The credentials provided for the SharePoint source are invalid."

     

    Can you help me to configure it correctly?

    Steps I have done:

     

    1. Creation of a new Serive principle (single tenant app)

    2. I have added Sites.Read.All permission, both for MS Graph and SharePoint

    3. I have created new AAD Group and I have added my Service Principle to it

    4. In PowerBI admin settings I have enabled "Service principals can access read-only admin API" and assigned this group to it

     

    After that, when trying to change authentication method to Service Principal and writing tenant ID, App ID and client secret I recievie the error

    • tayloramy's avatar
      tayloramy
      Icon for Super User rankSuper User
      10 months ago

      Hi Bodyes, 
      I believe you need to use the legacy permissions for the service principal and grant access directly in the sharepoint site at this page: /_layouts/15/appregnew.aspx

       

      If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.  

      • Bodyes's avatar
        Bodyes
        Regular Visitor
        10 months ago

        Hi tayloramy 

        There is information saying that ACS will no longer be able to access SharePoint after april 2026 so is it good idea to even try this solution? What is more, should I create new app or try to grant permissions via _layouts/15/appinv.aspx?

  • yashaswi_raj's avatar
    yashaswi_raj
    Icon for Helper I rankHelper I
    10 months ago

    Hi tayloramy , 

    can you explain this -then explicitly grant the app access to the specific site. 
    how to do it 

    • tayloramy's avatar
      tayloramy
      Icon for Super User rankSuper User
      10 months ago

      Hi yashaswi_raj, 

      This is done with the legacy permissions page: /_layouts/15/appregnew.aspx

       

      If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.