Authentication to Sharepoint via Workspace Identity

[Bodyes]

Hi

We have an issue with connection to our SharePoint site to get data from it to our PowerBi.

We have created a PowerBI workspace and we want to use Workspace Identity as an authentication method to our SharePoint site.

First of all, what PowerBI license do I need to have to achieve it? Currently we are running inside PBI Pro environment, do we need to have PBI Premium?

Steps I took:

1. I have created a Service Principle in entra enetrprise apps connected to PowerBi Workspace, its "state" in PBI options is "Active"

2. I granted to this SPN API permission "Site.Selected" (MS Graph and SharePoint) and via MS Graph I have assign role "owner" for my app to site which I want to get data from.

3. I have created an MS Entra group and invited as a member my SPN, then I have assigned "Member" role to sharepoint site.

4. In PBI, I have created new raport in PBI Desktop, I have connected to SharePoint as data source (using SharePoint Folder in "get data" tab) then publish it to my Workspace

With my microsoft account I am able to refresh data but with Workspace Identity method I recieve an error:
The credentials provided for the SharePoint source are invalid. (Source at https://nowystylglobal.sharepoint.com/sites/Self-ServiceBIAnalytics.). The exception was raised by the IDbCommand interface.

[Bodyes]

Hi @tayloramy again,

I have one more question: what do you mean by "those SharePoint connectors"? Does that mean that every way to connect to SharePoint won't work with Workspace Identity?

[tayloramy]

Hi @Bodyes, 

That is correct. It is not supported yet. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.  

[tayloramy · Accepted solution]

Hi @Bodyes,

Today, those SharePoint connectors don’t support Workspace identity, so the Service can’t acquire a token with that auth type and you get “The credentials provided for the SharePoint source are invalid.”

Quick solution
1) Don’t use Workspace identity for SharePoint (for now). Use a Service Principal (“app-only”) or a standard Organizational account.
2) You do not need Premium just to refresh a dataset that reads SharePoint with a Service Principal. Pro is fine.
3) If you choose Service Principal, grant it “Sites.Selected” on both Microsoft Graph and SharePoint, and then explicitly grant the app access to the specific site. Finally, set dataset credentials in the Service to OAuth2 > Service principal.

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[yashaswi_raj]

Hi @tayloramy , 

can you explain this -then explicitly grant the app access to the specific site. 
how to do it 

[tayloramy]

Hi @yashaswi_raj, 

This is done with the legacy permissions page: /_layouts/15/appregnew.aspx

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.  

[Bodyes]

Hi @tayloramy,

I tried to authenticate to SharePoint via new Service Principal method but unfortunately I recieved the same error which I got with Workspace identity "The credentials provided for the SharePoint source are invalid."

Can you help me to configure it correctly?

Steps I have done:

1. Creation of a new Serive principle (single tenant app)

2. I have added Sites.Read.All permission, both for MS Graph and SharePoint

3. I have created new AAD Group and I have added my Service Principle to it

4. In PowerBI admin settings I have enabled "Service principals can access read-only admin API" and assigned this group to it

After that, when trying to change authentication method to Service Principal and writing tenant ID, App ID and client secret I recievie the error

[tayloramy]

Hi @Bodyes, 
I believe you need to use the legacy permissions for the service principal and grant access directly in the sharepoint site at this page: /_layouts/15/appregnew.aspx

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.  

[Bodyes]

Hi @tayloramy 

There is information saying that ACS will no longer be able to access SharePoint after april 2026 so is it good idea to even try this solution? What is more, should I create new app or try to grant permissions via _layouts/15/appinv.aspx?

[tayloramy]

Hi @Bodyes, 

Yes, the legacy permissions are end of life, but they are also the only permissions that work with Fabric, so I guess pick your battles, if you want to do this now, use the legacy permissions, if you don't want to use anything that is end of life soon, wait until Fabric has a better solution and updated sharepoint permission flows. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.  

[Bodyes]

Hi @tayloramy,

Thanks a lot for your suggestions, to be honest I was sure that I can use Workspace Identity for authentication

I'll later that day try your idea but I will mark it as solution now

Once more, thanks a lot!