Forum Discussion
Power BI SSAS Connection Issue on Azure VM Gateway
Hello everyone,
I have an on-premises server, and I purchased an Azure VM because my SSAS is currently hosted on-premises and I want to migrate it to Azure. I have already completed the migration.
I have a report that uses data from both SQL and SSAS(Everything is in azure vm). Please note that the gateway configuration is also installed on the same Azure VM.
For SQL, I published the report to app.powerbi.com, and everything works fine. However, when I try to view the report with SSAS, I receive the following error:
“There was a data source access error. Please contact the gateway administrator.”
At this point, I am not sure what is causing the issue, but I suspect it may be related to the domain configuration.
Could you please advise what might be wrong?
Hi uzuntasgokberk ,
Thank you for reaching out to the Microsoft Community Forum.
Hi Poojara_D12 and lbendlin , Thank you for your prompt responses.
Hi uzuntasgokberk , please try the below things to fix the issue.
1. Could you please confirm whether your SSAS Mode is SSAS Multidimensional / Tabular (Windows Auth), SSAS Tabular (Mixed / Basic) or Azure Analysis Services, it will help us to fix the issue.
Note: If you are using Windows Authentication, everything that follows must be correct.
2. Please follow Authentication Flow, When Power BI Service queries SSAS via the gateway, the flow is:
Power BI Service (user identity) --> On‑premises Data Gateway service account --> (Kerberos delegation) SSAS service account.
Note: You got the error as “There was a data source access error. Please contact the gateway administrator.” Please check with your Gateway administrator.
3. Your Gateway must run under a domain user account not Local Machine Account, Local user and Managed Service Account without delegation. Please check on the VM: Services --> On-premises data gateway --> Log On. It should be something like: DOMAIN\PowerBIGatewaySvc
Note:- If you are using the default NT SERVICE\PBIEgwService, Kerberos cannot work.
4. Please Eliminate duplicate SPNs, if you haveduplicate SPNs on ANY OTHER ACCOUNT, Kerberos will fail.
5. In Power BI Service --> Manage Gateways --> SSAS Data Source
Use Windows Authentication, Enable “Use Single Sign-On (SSO)” and Server name must match SPN.
I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
Hello v-dineshya ,
Thank you for your response. The issue has been resolved by creating a Local Domain Controller in the machine’s Active Directory. For the gateway and SSAS services, we configured them to use a newly created user from the Local DC instead of the default configuration. This resolved the problem.
Kind Regards,
Gökberk Uzuntaş
🔗 Stay Connected:
📘 Medium |
📺 YouTube |
💼 LinkedIn |
📷 Instagram |
🐦 X |
👽 Reddit |
🌐 Website |
🎵 TikTok |
7 Replies
This issue is almost certainly related to authentication and identity delegation, not the gateway installation itself. When your report connects to SQL, it works because SQL connections via the gateway can use stored credentials, but SQL Server Analysis Services typically relies on Windows/Entra identity (SSO), and that’s where things break after moving to an Azure VM. Even though your gateway is on the same VM, the Power BI Service cannot automatically pass the user identity to SSAS unless Kerberos delegation (for on-prem AD) or proper Entra ID configuration is set up. If your SSAS instance is still using Windows authentication and the VM is not correctly domain-joined or delegation is not configured, the gateway will fail with a generic “data source access error.” You need to verify that (1) the Azure VM is properly joined to the domain, (2) the gateway service account has “Trusted for Delegation” enabled in Active Directory, and (3) SPNs are correctly registered for SSAS. Alternatively, if you want to avoid Kerberos complexity, configure the SSAS data source in the gateway to use stored credentials instead of SSO, but then all users will access data under a single identity. In short, nothing is wrong with Power BI—this is a classic SSAS + gateway + identity delegation misconfiguration after moving to Azure.
We are attempting to resolve this issue without relying on an Entra ID-based solution, focusing instead on points (1) and (2) above. For point (3), I have tried executing the relevant PowerShell command to register the SPNs, but unfortunately it did not resolve the issue.
Could you kindly advise on the next steps I should take, or share any additional troubleshooting recommendations based on your experience?
Thank you very much in advance for your time and support.
Best regards,
Gökberk Uzuntaş
Hi uzuntasgokberk ,
Thank you for reaching out to the Microsoft Community Forum.
Hi Poojara_D12 and lbendlin , Thank you for your prompt responses.
Hi uzuntasgokberk , please try the below things to fix the issue.
1. Could you please confirm whether your SSAS Mode is SSAS Multidimensional / Tabular (Windows Auth), SSAS Tabular (Mixed / Basic) or Azure Analysis Services, it will help us to fix the issue.
Note: If you are using Windows Authentication, everything that follows must be correct.
2. Please follow Authentication Flow, When Power BI Service queries SSAS via the gateway, the flow is:
Power BI Service (user identity) --> On‑premises Data Gateway service account --> (Kerberos delegation) SSAS service account.
Note: You got the error as “There was a data source access error. Please contact the gateway administrator.” Please check with your Gateway administrator.
3. Your Gateway must run under a domain user account not Local Machine Account, Local user and Managed Service Account without delegation. Please check on the VM: Services --> On-premises data gateway --> Log On. It should be something like: DOMAIN\PowerBIGatewaySvc
Note:- If you are using the default NT SERVICE\PBIEgwService, Kerberos cannot work.
4. Please Eliminate duplicate SPNs, if you haveduplicate SPNs on ANY OTHER ACCOUNT, Kerberos will fail.
5. In Power BI Service --> Manage Gateways --> SSAS Data Source
Use Windows Authentication, Enable “Use Single Sign-On (SSO)” and Server name must match SPN.
I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
That's an interesting thread.
We have the same issue: PBI service --> Gateway --> SSAS.
We have installed the gateway on the same machine where SSAS is running, and there is NO domain.
Is this a supported scenario?Hi alberto_gastald ,
No, that is not a supported scenario by design. SSAS + Power BI gateway relies on Kerberos, and Kerberos requires Active Directory. Join SSAS VM to Active Directory, Use domain service accounts and Configure SPNs + constrained delegation.
I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
As I understand it the gateway connection user must have DISCOVER privileges to SSAS, which is a big no-no in most environments.
