Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Get certified in Microsoft Fabric—for free! For a limited time, the Microsoft Fabric Community team will be offering free DP-600 exam vouchers. Prepare now

Reply
joshuatoon
New Member

Azure PIM Breaks Scheduled Refresh

I'm using the O365 Adoption Content Pack as well as Azure PIM. The scheduled refresh of data fails if you aren't always in the global admin role. Using Azure PIM my account is removed from that role after a timeout period. 

4 REPLIES 4
v-haibl-msft
Microsoft Employee
Microsoft Employee

@joshuatoon

 

To instantiate the O365 Adoption content pack, you have to be either a global administrator, Exchange administrator, Skype for Business administrator, or SharePoint administrator.

 

Using Azure PIM your account is removed from that role after a timeout period. This is as expected, right? If this is the case, I do not think it is an issue, and you should grant permanent permission to the account.

 

Best Regards,
Herbert

Yes it removes you from a role after a time. That's the whole point. I elevate my permissions long enough to do something then I go back to being a normal user. 

 

 

For the schedudled refresh to work you would have to have a role assigned permanently. We don't want out administrators to have permissions on a permanent basis. In fact, Microsoft says that using Azure PIM is a best practice. If the adoption content pack doesn't work with Azure PIM, that's a problem. 

@joshuatoon

 

This should be a limiation in such scenario. The O365 Adoption content pack needs admin permission, but Azure PIM will remove the permission after a timeout period. Then the refresh will be failed because of not enough permission.

Both products are working as expected in their way. If Power BI schedule refresh can trigger the role activation in Azure PIM, that would be perfect.

 

Best Regards,
Herbert

Why does the content pack need to refresh as the user? Why can't it be registered as an application in the directory that has permissions directly assigned?  In that scenario, the user doesn't need admin permissions all the time, they only need to be able to consent to giving the application permission one time. That's how everything else works with the Graph API. 

 

Helpful resources

Announcements
OCT PBI Update Carousel

Power BI Monthly Update - October 2024

Check out the October 2024 Power BI update to learn about new features.

September Hackathon Carousel

Microsoft Fabric & AI Learning Hackathon

Learn from experts, get hands-on experience, and win awesome prizes.

October NL Carousel

Fabric Community Update - October 2024

Find out what's new and trending in the Fabric Community.

Top Solution Authors
Top Kudoed Authors