Forum Discussion
PBI Gateway to Azure Databricks Connection Error: Unable to start OAuth login for this data source?
G'day folks
My team is looking into using Azure Databricks as a data source and am hitting an error
Background: Our Azure Databricks is on a "Private Link" I believe is the terminology (I need to use a VPN in order to login to it). I can connect to Azure Databricks through PBI Desktop using my Azure Active Directory once logged into VPN.
Next step was to upload a very basic PBI desktop report to the service and try to refresh it there. Since our Azure Databricks is set up with a "Private Link" (not publicly available) I assumed we would need to create a gateway connection (PBI Gateway)
My issue is when I try to create a gateway to connect to our Azure Databricks instance I am hitting a few walls (errors)
When creating the gateway I see the following 3 initial options
1) On Premise
2) Virtual network
3) Cloud
We do have some on premise Oracle databases that we have used a gateway to set up connections to which is working just fine.
Initially I assumed that I would need to configure an "On Premise" Gateway again since our Azure Databricks has a "Private Link" and I see the following login options
1) Username/Password (As per Databricks sounds like this is deprecated as of July 2024)
2) Personal Access Token
3) Azure Active Directory
I chose Azure Active Directory and then I see the following
So when I try to click on "Edit Credentials" I then hit the following error
Details: PBI_GW01: Unable to connect to the remote server Please have this information handy if you choose to create a support ticket. Session Id: 9e0c2aab-0972-4c90-8a3c-f88bfd8f3355 RequestId: 8b32568e-791d-4272-bcc1-9b36c4e8ef6a Cluster URI: https://api.powerbi.com Status code: 400 Time: Mon Feb 10 2025 16:04:51 GMT-0500 (Eastern Standard Time)
Few questions
1) Given our Azure Databricks set up being on a private link is it fair to assume firstly we do need a PBI gateway?
2) I was trying to find more information but I cant seem to figure out whether I should use an "On Premise" vs "Cloud" connection?
Although Azure Databricks is on the cloud its technically "private" and not publicly available.
Any insight would be greatly appreciated
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.
7 Replies
Hi rodneyc8063
What you need to make this work is you need to install and configure is VNET gateway. Here are details. What is a virtual network (VNet) data gateway | Microsoft Learn
Hi rodneyc8063,
Thanks for reaching out to the Microsoft fabric community! We understand you're encountering an OAuth login error while trying to connect Azure Databricks (with Private Link) to Power BI Service via a gateway. Let’s go through your queries one by one and troubleshoot the issue.
1) Yes, since your Azure Databricks is configured with Private Link, it is not accessible over the public internet. In this case, a Power BI Gateway is required to enable secure communication between Power BI Service and your Databricks instance. The gateway will act as a bridge to facilitate the data refresh in the Power BI Service.
2) Since your Databricks instance is in Azure but private (not publicly accessible), you should use a Virtual Network Data Gateway rather than an On-Premises Gateway.
- The On-Premises Data Gateway is typically used for databases hosted on local infrastructure. The Cloud option does not apply here because your Databricks instance is private. Use a VNet Gateway that is deployed in the same Azure region as your Databricks instance.
3) The error message suggests that the gateway is unable to establish a connection. Here are some potential causes and solutions:
- Please ensure that Azure Databricks Private Link is correctly configured to allow traffic from the Power BI Gateway.
- If using an On-Premises Gateway, confirm that the firewall is not blocking traffic.
- If you're using Azure Active Directory (AAD) Authentication, ensure:
- The Power BI Service Principal has the correct RBAC permissions to access Databricks.
- The OAuth token is not being blocked by Conditional Access Policies (CAPs) or MFA requirements.
- The user account has the correct Databricks workspace permissions (Viewer/Editor/Admin).
- If OAuth isn't working, try setting up authentication using a Personal Access Token (PAT) and check if the connection succeeds.
If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.Hi v-ssriganesh - Appreciate the detailed reply! Going to bring this to my admins to trouble shoot further but one quick question
You mentioend the "PBI service principal" - Do you mean or are you implying that we should create a service principal to connect from PBI to Azure Databricks?
I see a lot of documentation suggesting to use a PBI service principal (I admit I havent used this option before so pardon the very basic questions). When using a service principal to connect over the gateway I am not sure which option to choose for the authentication method
* Username/password -> I believe as per Databricks this is discontinued, and I dont believe a service principal would have this info
* Personal access token->Not sure if this is recommended with a service principal as I am not sure if the token expires? Also not sure why cant a "regular" user use their own service token instead of having to create a service principal
* Azure Active Directory-> If we are using a service principal not sure if this can be used
Not sure if I mixed something up here but I welcome any help!
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.
- The On-Premises Data Gateway is typically used for databases hosted on local infrastructure. The Cloud option does not apply here because your Databricks instance is private. Use a VNet Gateway that is deployed in the same Azure region as your Databricks instance.
Hi rodneyc8063,
May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.
Thank you.
Hi rodneyc8063,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.
