Destruction of credentials

[biscuitking]

Power BI deployment pipelines can and do destroy credentials, and there is currently no mechanism to preserve, restore, or warn about that.  Version control doesn't fix this.  There is no rollback function.    

Want to check the deployment rules before migrating?  You aren't the model owner, so you can't even look at the rules.  It doesn't matter that you are listed as a workspace owner.  

If we can't view basic things like deployment rules, at least warn us when a deployment will result in a different data source identity and therefore invalidate bindings/credentials.

[biscuitking]

Service Principals seem to be the solution.  20/20 hindsight says that we should have evaluated how much more intervention would be required by global administrators to make much of this work.

[v-hjannapu]

Hi @biscuitking,

Yes, you are correct. When using Service Principals, some setup from Global Admin side is required, like app registration and enabling the required tenant settings. Many times this part is understood only later, once we start implementing it.

If you are planning to move ahead with Service Principal setup and need any clarification on specific steps, please let us know. We will help based on that.

Regards,
Community Support Team.

[Olufemi7]

Hello @biscuitking, 

This is expected behavior in Power BI Deployment Pipelines. Credentials are environment-specific and are not deployed. If deployment rules or bindings change the data source identity, credentials may need reconfiguration, and there is no rollback or versioning. Deployment rule visibility depends on pipeline permissions, not workspace roles.

Best practice is to keep data source identities consistent across environments and automate re-binding where needed.

Microsoft docs:
Introduction to deployment pipelines 
Get started with deployment pipelines 

[MohdZaid_ · Accepted solution]

Hey @biscuitking , 

You're absolutely right deployment pipelines currently don’t provide visibility into credential impact or deployment rule changes unless you're the dataset owner. There’s also no rollback mechanism if credentials are invalidated during deployment.

This is a known limitation rather than a configuration mistake. Until Microsoft improves this, the safest approach is standardizing data source identities across environments and using service principals to maintain consistent ownership and rule visibility.

It would definitely improve the product if Microsoft added a pre-deployment impact analysis that flags identity changes and potential credential loss.

If this solved your issue, please mark it as the solution so others can find it easily.

If it helped, a quick 👍 Kudos is always appreciated it helps highlight useful answers for the community.

Thanks for being part of the discussion !!!