Finding what service account people are using for their reports

[jarwest]

Hey all,

I have a lot of dataflows in my workspaces, all made by several people. I would like to gather information on who owns each dataflow, what it connects to, and, most importantly, what credentials they used. I would like to know if the used a microsoft account credential, or a service account, and if so, which service account they used. I'd like this information so I can alter permissions on certain service accounts and understand the potential risk of said changes, and so I can understand the ramifications for if certain Microsoft accounts are disabled.

Any and all help is appreciated. If some of these are impossible, that is valuable information to have. I've been exploring the API but I'm not having much luck yet.

[v-dineshya]

Hi @jarwest ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

Please check below things.

1. Identify Dataflow Owners

Use the Power BI REST API to list dataflows and extract the owner:

Endpoint: GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/dataflows

Response includes createdBy and modifiedBy fields — these typically contain the UPN (email) of the user.

Note: Loop through all workspaces (GET /groups) and then get dataflows per workspace.

2. Get Dataflow Connection Details

Endpoint: GET /groups/{groupId}/dataflows/{dataflowId}/datasources

This gives you the connection type (e.g SQL Server, SharePoint, etc.), server/database name, etc.

Note: You don’t get the actual credentials or UPN of the credential used. Just the connection details.

3. Determine What Type of Credential Was Used (Service Account vs. User Account)

This information is not exposed through the Power BI REST API.

4. Identify the Exact UPN Used in the Gateway or OAuth Credential

Even with Admin APIs or service principal permissions, Microsoft does not expose the username of the credential used in the connection string for dataflows.

Please follow below things to fix the issue.

1. Use the Power Platform Admin Connector (PowerShell or Power Automate)

While limited on credential details, you can enrich your metadata on Dataflows, Data connectors, Modified/created info and
Workspace access.

2. Enforce Service Account Naming Conventions

If you already require that service accounts follow a naming convention (e.g svc_powerbi_sales@...), you can infer risk from the createdBy field of dataflows.

3. Export Gateway Data Sources (On-Prem Only)

If using gateways, Use the Data Gateway REST API or Admin Portal to list gateway data sources. It may show who last modified a data source and the type of credential (Windows/Basic/Anonymous/OAuth).

If my response has resolved your query, please mark it as the "Accepted Solution" to assist others. Additionally, a "Kudos" would be appreciated if you found my response helpful.

Thank you

[JMLyle]

I just happened to have some PowerShell that does a quick view of what @v-dineshya describes in the first option:

[array]$DatasetObjects = Get-PowerBIDataset -Scope Organization -WorkspaceId $WorkspaceId
$DatasetObjects | Format-Table -auto Id,Name,ConfiguredBy,IsOnPremGatewayRequired

Shows some info. ConfiguredBy is the person who currently "owns" the Data Source connection (could be the creator or the most recent person to take ownership of the Semantic Model in order to configure a refresh).

[SaiTejaTalasila]

Hi @jarwest ,

@JMLyle is correct. You can't get any credentials, and you can spend sometime and get all other details.

Thanks,

Sai Teja 

[JMLyle · Accepted solution]

I've asked this before, and I don't believe there is any way to extract the credential.

Of course there's no way to extract the password, but the username is also apparently encrypted along with the password, so it is unavailable as well, as I understand it.

However, you can get other details about connections using the DataGateway PowerShell module.

$DataSource = Get-DataGatewayDatasource | Where-Object {$_.Id -eq $DataSourceID}
$DataSource | Format-List DatasourceName,ClusterName,DatasourceType,ConnectionDetails,DatasourceReference

Also helpful is:

Get-DataGatewayClusterDatasourceStatus -GatewayClusterId $DataSource.ClusterId -GatewayClusterDatasourceId $DataSource.Id

EDIT: Re-reading your question, you aren't specifically refering to On-Premises Data Gateways though, so not sure if this will be helpful or not.