Forum Discussion
Powerbi.com not passing credentials to Snowflake
We are trying to use Snowflake security policies and user roles to allow our customers to only see their data through Power BI reports.
The issue is when our users access the published report in powerbi.com, the credentials used in Snowflake are the same login that was used to publish the report and dataset file.
Our configuration is:
- Using Azure SSO through active directory and scim.
- Created security integration between Azure and Snowflake.
- Snowflake is IP secured and running in AWS. Powerbi.com IPs have been included in the policy.
- We have separate report and dataset files that are published to powerbi.com.
- Users are granted viewer access to the report only.
- We are using PowerBI direct query to query Snowflake live.
Observations so far:
- Logins per email are being created in Snowflake.
- Users are getting an email notice that they have access to the report.
- All Snowflake queries are executing as the same user that published the report.
Any thoughts on what we are missing to have the user queries run with their corresponding Snowflake login?
For users in the our domain their queries run without issue using their login. When testing customer access where their email domain would be outside (gmail, etc), those users have a login we can see in snowflake but get credentials error in powerbi.com trying to run a report. We have tested with all (external and internal) having the same SF roles and default warehouse. When looking at login attempts we do not see the external test user even attempting to login.
