Forum Discussion
PBI Gateway to Azure Databricks Connection Error: Unable to start OAuth login for this data source?
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.
Hi v-ssriganesh - Appreciate the detailed reply! Going to bring this to my admins to trouble shoot further but one quick question
You mentioend the "PBI service principal" - Do you mean or are you implying that we should create a service principal to connect from PBI to Azure Databricks?
I see a lot of documentation suggesting to use a PBI service principal (I admit I havent used this option before so pardon the very basic questions). When using a service principal to connect over the gateway I am not sure which option to choose for the authentication method
* Username/password -> I believe as per Databricks this is discontinued, and I dont believe a service principal would have this info
* Personal access token->Not sure if this is recommended with a service principal as I am not sure if the token expires? Also not sure why cant a "regular" user use their own service token instead of having to create a service principal
* Azure Active Directory-> If we are using a service principal not sure if this can be used
Not sure if I mixed something up here but I welcome any help!
Hi rodneyc8063,
Thank you for your follow-up. These are important questions, and I am happy to clarify the confusion regarding the Service Principal and Authentication Method when connecting Azure Databricks via a Power BI Gateway. Let's break it down:
- What is a Service Principal and When to Use it?
A Service Principal is essentially an identity created in Azure Active Directory (AAD) that represents an application or service (like Power BI) rather than a user. It’s commonly used for automated, secure, non-interactive access to Azure resources, including Databricks. So, Yes, you can create a Service Principal in AAD and grant it access to Azure Databricks. This approach is often preferred over personal tokens for governance and security.
Relevant offical doc link : Configure a service principal for Azure Databricks
- Which Authentication Method Should You Use with a Service Principal?
- For Service Principal → Power BI Gateway → Databricks, AAD (Azure Active Directory) authentication is generally the best practice. However, PAT (Personal Access Token) is also valid if you prefer that route but requires token management (renewals).
- How to Set Up AAD Authentication with Service Principal (High-Level Steps)
- Create a Service Principal in Azure AD. Assign it appropriate workspace permissions in Databricks (like Viewer, Editor, Admin, or custom RBAC roles).
- Enable Service Principal Authentication in your Databricks workspace (if not already enabled). Grant the Service Principal access to the Databricks API (Workspace Admin → Admin Settings → Service Principals).
- Use "Azure Active Directory" as the authentication method in Power BI Gateway configuration. When prompted for credentials, provide the Service Principal’s details (Client ID, Tenant ID, and Client Secret).
- Can a Regular User Use Their Own Token Instead?
Yes, they can.
A Personal Access Token (PAT) can be generated by any Databricks user with the right workspace access. However, for production scenarios and scheduled refreshes via a gateway, it’s generally better to use a Service Principal for better security and control.
I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.
Hi v-ssriganesh
I am also trying to connect with a Service Principal but when I click on edit credentials, I am presented with the regular Microsoft login page (https://login.microsoftonline.com/) asking for an email. There isn't a place to enter the details you mentioned: Client ID, Tenant ID, and Client Secret.
Is there additional configuration that I am missing in my Tenant / Fabric / Power BI to enable this? Or where am I going wrong?
Thanks in advance,
Steve
