Forum Discussion
PBI Gateway to Azure Databricks Connection Error: Unable to start OAuth login for this data source?
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.
Hi rodneyc8063,
Thanks for reaching out to the Microsoft fabric community! We understand you're encountering an OAuth login error while trying to connect Azure Databricks (with Private Link) to Power BI Service via a gateway. Let’s go through your queries one by one and troubleshoot the issue.
1) Yes, since your Azure Databricks is configured with Private Link, it is not accessible over the public internet. In this case, a Power BI Gateway is required to enable secure communication between Power BI Service and your Databricks instance. The gateway will act as a bridge to facilitate the data refresh in the Power BI Service.
2) Since your Databricks instance is in Azure but private (not publicly accessible), you should use a Virtual Network Data Gateway rather than an On-Premises Gateway.
- The On-Premises Data Gateway is typically used for databases hosted on local infrastructure. The Cloud option does not apply here because your Databricks instance is private. Use a VNet Gateway that is deployed in the same Azure region as your Databricks instance.
3) The error message suggests that the gateway is unable to establish a connection. Here are some potential causes and solutions:
- Please ensure that Azure Databricks Private Link is correctly configured to allow traffic from the Power BI Gateway.
- If using an On-Premises Gateway, confirm that the firewall is not blocking traffic.
- If you're using Azure Active Directory (AAD) Authentication, ensure:
- The Power BI Service Principal has the correct RBAC permissions to access Databricks.
- The OAuth token is not being blocked by Conditional Access Policies (CAPs) or MFA requirements.
- The user account has the correct Databricks workspace permissions (Viewer/Editor/Admin).
- If OAuth isn't working, try setting up authentication using a Personal Access Token (PAT) and check if the connection succeeds.
If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily.
Thank you.
Hi v-ssriganesh - Appreciate the detailed reply! Going to bring this to my admins to trouble shoot further but one quick question
You mentioend the "PBI service principal" - Do you mean or are you implying that we should create a service principal to connect from PBI to Azure Databricks?
I see a lot of documentation suggesting to use a PBI service principal (I admit I havent used this option before so pardon the very basic questions). When using a service principal to connect over the gateway I am not sure which option to choose for the authentication method
* Username/password -> I believe as per Databricks this is discontinued, and I dont believe a service principal would have this info
* Personal access token->Not sure if this is recommended with a service principal as I am not sure if the token expires? Also not sure why cant a "regular" user use their own service token instead of having to create a service principal
* Azure Active Directory-> If we are using a service principal not sure if this can be used
Not sure if I mixed something up here but I welcome any help!
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.Hi v-ssriganesh
I am also trying to connect with a Service Principal but when I click on edit credentials, I am presented with the regular Microsoft login page (https://login.microsoftonline.com/) asking for an email. There isn't a place to enter the details you mentioned: Client ID, Tenant ID, and Client Secret.
Is there additional configuration that I am missing in my Tenant / Fabric / Power BI to enable this? Or where am I going wrong?
Thanks in advance,
Steve
