Authenting to Fabric Lakehouse SQL Endpoint using Service Principal

[jeremic_nikola]

Hi,

I am using App-Owns-Data embed scenario in a multi-tenant environment. Some of my paginated reports need connection to Fabric Lakehouse (data is from MongoDB so needs to be preprocessed and stored in a Lakehouse).

When assigning report to a tenant (copying the report from master workspace) I need to patch credentials. I am using PowerBI API 4.16. - Gateways.UpdateDataSourcesAsync method. I am trying to patch credentials of a service principal. I've tried to create credentials using basic authentication as well as OAuth2. I am unable to patch Service Principal credentials (receiving Unauthorized response from the API. The same happen when I try Service Principal authentication over Azure SQL database. 

Did anyone have similar issue? Any suggestions?

Thanks and regards,

Nikola

[v-zhangti]

Hi, @jeremic_nikola 

According to the Microsoft documentation, you need to follow these steps:

• 1.Create an Azure AD app and take note of the App-Id. Make sure the app doesn’t have any admin-consent required permissions for Power BI set on it in the Azure portal.
• 2.Create a new Security Group in Azure Active Directory and add your App-Id as a member of the group.
• 3. Enable the Power BI service admin settings and select the Specific security groups option. Add the security group you created in the previous step.
• 4. Discover the data sources of the dataset by calling Get Datasources and take note of the gateway ID and data source ID.
• 5. Retrieve the gateway public key by calling Get Gateway.
• 6. Build the credentials string according to the Update Datasource Examples.
• 7. Encrypt the credentials string with the gateway public key.
• 8. Build the credential details with encrypted credentials.
• 9. Set credentials by calling Update Datasource.

You can also use PowerShell scripts to patch the credentials of the dataset, as shown in this example.

How to update Azure SQL datasource credentials of PowerBI dataset programmatically? - Stack Overflow

For reference:

Enable service principal authentication for read-only admin APIs - Power BI | Microsoft Learn

Configure credentials programmatically for Power BI embedded analytics - Power BI | Microsoft Learn

Best Regards,

Community Support Team _Charlotte

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jeremic_nikola]

Hi,

Thanks, this is much appreciated. However, is there an example of creating credentials with service principal authentication?

All other credential types are working, but the one with Service principal is not documented. Should I use Basic? OAuth2?  And also, I am using all cloud data sources. 

Should i still be following the article:

Configure credentials programmatically for Power BI embedded analytics - Power BI | Microsoft Learn