Direct Query AAD Passthrough Databricks Power BI Requirements

[frankvb]

I am looking for the exact requirements for setting up AAD Passthrough like outlined here:

Security set up for power bi and databricks

Direct Query on AAD Passthrough

In both of the above scenarios, fine grained access control policies would need to be set up both in Unity Catalog (for users that are consuming directly through DBSQL) and Power BI. If you do not want to set up a dual security model, and instead use Unity Catalog to govern everything without having to set up access control in Power BI, you can opt for AAD passthrough.

This is the preferred architecture if you want to simply your access control setup. You will need to set up a direct query semantic model. There will be a checkbox in “Edit data source credential” that says “Report viewers can only access data source with their own Power BI identities using DirectQuery”. If you tick that checkbox, Power BI will pass down the AAD identity to Databricks SQL Warehouse, which will enable Unity Catalog to check whether that end user's AAD identity has access to certain tables, views, and rows/columns.

Firstly, is this possible on power bi pro licenses?

Do we need to set up a Databricks SQL Warehouse?

Or do you really need to set up Azure sql database or an Azure Synapse Analytics?

https://learn.microsoft.com/en-us/power-bi/connect-data/service-azure-sql-database-with-direct-conne... 

https://learn.microsoft.com/en-us/power-bi/connect-data/service-azure-sql-data-warehouse-with-direct... 

Here it seems to say just using databricks would be fine, but you need to set up a gateway?

Overview of single sign-on for on-premises data gateways - Power BI | Microsoft Learn

[frankvb]

I am trying to determine if there is some issue with the network or with a firewall, that prevents this to work right now.

So the fact that I get this error message is not due to our set-up?

DataSource.Error: ODBC: ERROR [HY000] [Microsoft][ThriftExtension] (14) Unexpected response from server during a HTTP connection: Bad Status: Unrecognized response with no error message header. Status code: 400.. Microsoft.Data.Mashup.ErrorCode = 10478. DataSourceKind = Databricks. DataSourcePath = {"host":"","httpPath":""}. OdbcErrors = #table({"SQLState", "NativeError", "Message"}, {}). . De uitzondering is opgetreden voor de IDbCommand-interface.

[v-aatheeque · Accepted solution]

Hi @frankvb 

Based on the error message:
ODBC: ERROR [HY000] [Microsoft][ThriftExtension] (14) Unexpected response from server during a HTTP connection: Bad Status... Status code: 400
usually does not indicate a problem with your Power BI or Databricks setup itself.
This is more commonly caused by network-related issues, such as:

• A firewall blocking or interfering with outbound connections to Databricks.
• A proxy server or network appliance modifying or corrupting HTTP responses.
• TLS/SSL interception tools that alter certificate chains or HTTP headers.
  
  

Here are a few steps you could suggest for troubleshooting: 

• Make sure the host and httpPath fields in your connection string are correct.
  You can verify these in Databricks under: Compute → Cluster → Advanced Options → JDBC/ODBC.
• Try connecting from a different network (for example, a mobile hotspot) to see if the problem is linked to your corporate firewall or proxy.
• Check if any firewall or proxy is blocking or intercepting HTTPS traffic to *.databricks.com.
• Ask your IT or network team to whitelist *.databricks.com and ensure that HTTPS traffic over port 443 is allowed.
• Test your ODBC connection from another tool (like DBeaver or Tableau) to determine if the issue is specific to Power BI.

If these steps don’t resolve the problem, consider raising a Microsoft Fabric Support and Status | Microsoft Fabric with Microsoft or Databricks, and share the full error message and your connection details for further investigation.

Hope this helps !!

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

[Deku]

You should be fine with pro licences. You would preferably have a SQL warehouse, as that is optimized for BI use cases, but all purpose computer should also work.

If you databricks instance is on Azure you could just use cloud connections without a gateway. If the databrick workspace is on a VNET with public internet access turned off you need VNET or enterprise gateway within the VNET