Forum Discussion
Authentication to Sharepoint via Workspace Identity
Hi
We have an issue with connection to our SharePoint site to get data from it to our PowerBi.
We have created a PowerBI workspace and we want to use Workspace Identity as an authentication method to our SharePoint site.
First of all, what PowerBI license do I need to have to achieve it? Currently we are running inside PBI Pro environment, do we need to have PBI Premium?
Steps I took:
1. I have created a Service Principle in entra enetrprise apps connected to PowerBi Workspace, its "state" in PBI options is "Active"
2. I granted to this SPN API permission "Site.Selected" (MS Graph and SharePoint) and via MS Graph I have assign role "owner" for my app to site which I want to get data from.
3. I have created an MS Entra group and invited as a member my SPN, then I have assigned "Member" role to sharepoint site.
4. In PBI, I have created new raport in PBI Desktop, I have connected to SharePoint as data source (using SharePoint Folder in "get data" tab) then publish it to my Workspace
With my microsoft account I am able to refresh data but with Workspace Identity method I recieve an error:
The credentials provided for the SharePoint source are invalid. (Source at https://nowystylglobal.sharepoint.com/sites/Self-ServiceBIAnalytics.). The exception was raised by the IDbCommand interface.
Hi Bodyes,
Today, those SharePoint connectors don’t support Workspace identity, so the Service can’t acquire a token with that auth type and you get “The credentials provided for the SharePoint source are invalid.”
Quick solution
1) Don’t use Workspace identity for SharePoint (for now). Use a Service Principal (“app-only”) or a standard Organizational account.
2) You do not need Premium just to refresh a dataset that reads SharePoint with a Service Principal. Pro is fine.
3) If you choose Service Principal, grant it “Sites.Selected” on both Microsoft Graph and SharePoint, and then explicitly grant the app access to the specific site. Finally, set dataset credentials in the Service to OAuth2 > Service principal.If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
13 Replies
Hi Bodyes,
Today, those SharePoint connectors don’t support Workspace identity, so the Service can’t acquire a token with that auth type and you get “The credentials provided for the SharePoint source are invalid.”
Quick solution
1) Don’t use Workspace identity for SharePoint (for now). Use a Service Principal (“app-only”) or a standard Organizational account.
2) You do not need Premium just to refresh a dataset that reads SharePoint with a Service Principal. Pro is fine.
3) If you choose Service Principal, grant it “Sites.Selected” on both Microsoft Graph and SharePoint, and then explicitly grant the app access to the specific site. Finally, set dataset credentials in the Service to OAuth2 > Service principal.If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Hi tayloramy,
I tried to authenticate to SharePoint via new Service Principal method but unfortunately I recieved the same error which I got with Workspace identity "The credentials provided for the SharePoint source are invalid."
Can you help me to configure it correctly?
Steps I have done:
1. Creation of a new Serive principle (single tenant app)
2. I have added Sites.Read.All permission, both for MS Graph and SharePoint
3. I have created new AAD Group and I have added my Service Principle to it
4. In PowerBI admin settings I have enabled "Service principals can access read-only admin API" and assigned this group to it
After that, when trying to change authentication method to Service Principal and writing tenant ID, App ID and client secret I recievie the error
Hi Bodyes,
I believe you need to use the legacy permissions for the service principal and grant access directly in the sharepoint site at this page: /_layouts/15/appregnew.aspxIf you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Hi tayloramy ,
can you explain this -then explicitly grant the app access to the specific site.
how to do itHi yashaswi_raj,
This is done with the legacy permissions page: /_layouts/15/appregnew.aspx
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Did you ever get this working? I have the same issue
