Azure PIM Breaks Scheduled Refresh

[joshuatoon]

I'm using the O365 Adoption Content Pack as well as Azure PIM. The scheduled refresh of data fails if you aren't always in the global admin role. Using Azure PIM my account is removed from that role after a timeout period. 

[v-haibl-msft]

@joshuatoon

To instantiate the O365 Adoption content pack, you have to be either a global administrator, Exchange administrator, Skype for Business administrator, or SharePoint administrator.

Using Azure PIM your account is removed from that role after a timeout period. This is as expected, right? If this is the case, I do not think it is an issue, and you should grant permanent permission to the account.

Best Regards,
Herbert

[joshuatoon]

Yes it removes you from a role after a time. That's the whole point. I elevate my permissions long enough to do something then I go back to being a normal user. 

For the schedudled refresh to work you would have to have a role assigned permanently. We don't want out administrators to have permissions on a permanent basis. In fact, Microsoft says that using Azure PIM is a best practice. If the adoption content pack doesn't work with Azure PIM, that's a problem. 

[v-haibl-msft]

@joshuatoon

This should be a limiation in such scenario. The O365 Adoption content pack needs admin permission, but Azure PIM will remove the permission after a timeout period. Then the refresh will be failed because of not enough permission.

Both products are working as expected in their way. If Power BI schedule refresh can trigger the role activation in Azure PIM, that would be perfect.

Best Regards,
Herbert

[joshuatoon]

Why does the content pack need to refresh as the user? Why can't it be registered as an application in the directory that has permissions directly assigned?  In that scenario, the user doesn't need admin permissions all the time, they only need to be able to consent to giving the application permission one time. That's how everything else works with the Graph API.