Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

The ultimate Microsoft Fabric, Power BI, Azure AI & SQL learning event! Join us in Las Vegas from March 26-28, 2024. Use code MSCUST for a $100 discount. Register Now

Reply
joshuatoon
New Member

Azure PIM Breaks Scheduled Refresh

I'm using the O365 Adoption Content Pack as well as Azure PIM. The scheduled refresh of data fails if you aren't always in the global admin role. Using Azure PIM my account is removed from that role after a timeout period. 

4 REPLIES 4
v-haibl-msft
Employee
Employee

@joshuatoon

 

To instantiate the O365 Adoption content pack, you have to be either a global administrator, Exchange administrator, Skype for Business administrator, or SharePoint administrator.

 

Using Azure PIM your account is removed from that role after a timeout period. This is as expected, right? If this is the case, I do not think it is an issue, and you should grant permanent permission to the account.

 

Best Regards,
Herbert

Yes it removes you from a role after a time. That's the whole point. I elevate my permissions long enough to do something then I go back to being a normal user. 

 

 

For the schedudled refresh to work you would have to have a role assigned permanently. We don't want out administrators to have permissions on a permanent basis. In fact, Microsoft says that using Azure PIM is a best practice. If the adoption content pack doesn't work with Azure PIM, that's a problem. 

@joshuatoon

 

This should be a limiation in such scenario. The O365 Adoption content pack needs admin permission, but Azure PIM will remove the permission after a timeout period. Then the refresh will be failed because of not enough permission.

Both products are working as expected in their way. If Power BI schedule refresh can trigger the role activation in Azure PIM, that would be perfect.

 

Best Regards,
Herbert

Why does the content pack need to refresh as the user? Why can't it be registered as an application in the directory that has permissions directly assigned?  In that scenario, the user doesn't need admin permissions all the time, they only need to be able to consent to giving the application permission one time. That's how everything else works with the Graph API. 

 

Helpful resources

Announcements
Fabric Community Conference

Microsoft Fabric Community Conference

Join us at our first-ever Microsoft Fabric Community Conference, March 26-28, 2024 in Las Vegas with 100+ sessions by community experts and Microsoft engineering.

February 2024 Update Carousel

Power BI Monthly Update - February 2024

Check out the February 2024 Power BI update to learn about new features.

Fabric Career Hub

Microsoft Fabric Career Hub

Explore career paths and learn resources in Fabric.

Fabric Partner Community

Microsoft Fabric Partner Community

Engage with the Fabric engineering team, hear of product updates, business opportunities, and resources in the Fabric Partner Community.

Top Solution Authors
Top Kudoed Authors