Forum Discussion

aswathyjoe's avatar
aswathyjoe
Frequent Visitor
1 year ago
Solved

Best Practice for Scheduled Refresh Authentication in Power BI with Fabric Lakehouse SQL Endpoint

I'm a Power BI developer working with data stored in Microsoft Fabric Lakehouse. I connect to the Lakehouse using the SQL endpoint and publish my reports to the Power BI Service. When setting up sch...
Need Help
  • VahidDM's avatar
    VahidDM
    1 year ago

    aswathyjoe 

    Use a non-human identity. Don’t use your personal account.

    Best practice

    • Service principal (preferred): Enable “Allow service principals to use Power BI APIs” and allow specific security groups. Give the SPN Read/Use SQL endpoint (or Viewer) on the Lakehouse item or workspace; grant it Build on the semantic model. Store its secret in the dataset/fabric connection (OAuth2 → Service principal). Rotate the secret regularly (ideally via Key Vault).

    • Service account (fallback): If SPN isn’t allowed, use a dedicated Entra user account (no MFA for refresh), licensed appropriately, and placed in a group. Never tie refresh to a personal user.

    • Least privilege: Only grant what’s needed (no Admin/Member if not required). Scope access at the workspace or item level; avoid giving tenant-wide rights.

    • Operational hygiene: Set dataset owners/contacts to a group, monitor refresh with alerts/audit logs, and document the identity used so offboarding doesn’t break refresh.

    Short answer: Use a service principal for scheduled refresh to the Fabric Lakehouse SQL endpoint; avoid personal accounts.

VahidDM's avatar
VahidDM
Icon for Super User rankSuper User
1 year ago

aswathyjoe 

Use a non-human identity. Don’t use your personal account.

Best practice

  • Service principal (preferred): Enable “Allow service principals to use Power BI APIs” and allow specific security groups. Give the SPN Read/Use SQL endpoint (or Viewer) on the Lakehouse item or workspace; grant it Build on the semantic model. Store its secret in the dataset/fabric connection (OAuth2 → Service principal). Rotate the secret regularly (ideally via Key Vault).

  • Service account (fallback): If SPN isn’t allowed, use a dedicated Entra user account (no MFA for refresh), licensed appropriately, and placed in a group. Never tie refresh to a personal user.

  • Least privilege: Only grant what’s needed (no Admin/Member if not required). Scope access at the workspace or item level; avoid giving tenant-wide rights.

  • Operational hygiene: Set dataset owners/contacts to a group, monitor refresh with alerts/audit logs, and document the identity used so offboarding doesn’t break refresh.

Short answer: Use a service principal for scheduled refresh to the Fabric Lakehouse SQL endpoint; avoid personal accounts.