No UMI authentication method for PBI data sources? Device used during the authentication is disabled

[Nunila]

We shifted away from Service Principal secrets as part of the security wave. When looking at the available authentication methods, Managed Identity is not one of the options. Are there plans to implement User Managed Identity for both Kusto and Web data sources?

This has been an issue because the OAuth2 method is not working with the provided credentials when the PBI Report refreshes. Error details below:

Full error: 

There was an error when processing the data in the dataset.

Data source error:	{"error":{"code":"DMTS_OAuthTokenRefreshFailedError","pbi.error":{"code":"DMTS_OAuthTokenRefreshFailedError","details":[{"code":"DM_ErrorDetailNameCode_UnderlyingErrorMessage","detail":{"type":1,"value":"AADSTS135011: Device used during the authentication is disabled. Trace ID: 2ad039c5-f119-4eb8-bef9-6d48ed7e4500 Correlation ID: 8619e193-1197-44be-b2c5-f1f11d1ca31a Timestamp: 2024-06-17 23:52:46Z"}}],"exceptionCulprit":1}}} Table: Repair Items.
Cluster URI:	DF-MSIT-SCUS-redirect.analysis.windows.net
Activity ID:	66ced92c-88da-458f-9941-96e101c35db2
Request ID:	ba85d33d-69f7-f3f7-5e54-d2d9c8b77ca5

[Nunila]

Power BI Semantic models currently (as of 7/12/2024) don't support Managed Identity as authentication to sources. I fixed the issue by downloading the semantic model to work on it locally, going through my sources, re-authenticating as OAuth2, refreshing all queries separatly to make sure none had errors, and then republishing the report.  

[Anonymous]

Hi,@Nunila .I am gald to help you.

Based on your description, you want to ask if it is possible to implement User Managed Identity for Kusto data sources.

Unfortunately, I have not been able to find any documentation that explicitly states that it is possible to implement User Managed Identity for Kusto data sources in Power BI.

Can you tell me more about your configuration (not sensitive data)

For example, the type of data source you are currently connecting to.

In fact, I would recommend that you use the Service Principal method for data source authentication.

Are you connecting using a cloud-based data source?

like this.

Unfortunately, I am unable to reproduce your action due to my work environment: the connected data source type is Kusto.

So I use SharePoint as data source, but it fails to reproduce the problem.

Can you tell me if the account you are using for OAuth 2.0 authentication is a valid Power BI Service account?

I hope you can provide more detailed connection information and try to use service principals as the authentication method if possible ( if it works).

Here is the official documentation on this:
Use service principals & managed identities - Azure DevOps | Microsoft Learn
I am looking forward to your reply.

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.

Best Regards,

Carson Jian,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Nunila]

Hello @Anonymous,

Thanks for your response. If Power BI does not support Managed Identites as of today that is unfortunate - I suppose they're probably in process of developing it. 

We had Service Principal setup for the sources, but it requires a service principal key and that's what we're moving away from (usage of secrets). The other possibilities are anonymous and Basic, which are discarded. 

The sources I am having trouble with are of type Web, but they using kusto (they were autogenerated when using "Query To PowerBI" in kusto). OAuth2 is the only type that could fit in my scenario, and it doesn't throw any errors when it tests the connector, but on the actual Report refresh, it throws the error I mentioned above.

[Anonymous]

Hi,@Nunila.
Thank you for your reply.
Have you tried dataflow, by setting up dataflow you might be able to bypass the gateway refresh and refresh daraflow directly, you can try it (I can't test this way due to my environment):

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.

Best Regards,

Carson Jian,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.