Best Practices for what account to use for authenticating online files

[rachaelwalker]

I am looking for best practices regarding authenticating sharepoint excel files in power bi desktop. I am currently connected to an online sharepoint excel file using my credentials (Organization M365 account). Its a non-admin account but does have elevated permissions.  The datasource is also configured to use the cloud connection gateway. 

Should I be using a separte service account with bare minium permissions to authenticate my excel within power bi? I create reports/dashboards for internal employees only. I have tried google and the forum but I am having a hard time finding best practices for this specific question. Any advice or tips is welcomed and appreciated. Thank you!

[edhans · Accepted solution]

I honestly don't think it matters much. The main advantage of a service type account is if you leave, the reports continue to refresh, but even then, the token expires after a few months and has to be reauthenticated, which is a hassle for someone to do if it isn't their account, especially if 2FA is involved.

Your permissions for that to refresh does not convey any additional rights to a report user. They cannot get to SharePoint for example from your credentials. It is just for the service to refresh.

[rachaelwalker]

ok thats what I was thinking but my boss wants me to use a different account. This came up when he requested that I published a report using a excel file on his individual onedrive. Although he shared the file with me and I can access it, I am getting an authentication error in power bi. I will most likely run into this with a separate service account as well. Do you know if I need permissions to the folder as well? I am authenticating at the file level (last option in drop down). It says read only but the link has /:x/:g in it so I think that means its a guest link. 

[edhans]

I would strongly recommend avoiding connecting to files in individual OneDrive accounts. Even though there is SharePoint underneath, you will have permission issues. You can try getting permissions to the folder and see if that fixes it. If not, create a new Team/SharePoint that just you and he share. He stores the files there, and you and he (and your service account) have access to the SharePoint library site for refreshing.

He can sync that library to his PC. It is a one time move for him.