Powerbi.com not passing credentials to Snowflake

[cstewrun]

We are trying to use Snowflake security policies and user roles to allow our customers to only see their data through Power BI reports.
The issue is when our users access the published report in powerbi.com, the credentials used in Snowflake are the same login that was used to publish the report and dataset file.

Our configuration is:

• Using Azure SSO through active directory and scim.
• Created security integration between Azure and Snowflake.
• Snowflake is IP secured and running in AWS. Powerbi.com IPs have been included in the policy.
• We have separate report and dataset files that are published to powerbi.com.
• Users are granted viewer access to the report only.
• We are using PowerBI direct query to query Snowflake live.

Observations so far:

• Logins per email are being created in Snowflake.
• Users are getting an email notice that they have access to the report.
• All Snowflake queries are executing as the same user that published the report.

Any thoughts on what we are missing to have the user queries run with their corresponding Snowflake login?

[GilbertQ]

Hi @cstewrun 

Could you confirm that you have set up the data source as shown below.

[cstewrun]

Yes it is set up like your image.

[cstewrun]

I am sorry had a miscommunication with a co worker, we were set to "public" for privary level.  We now have changed to "Organizational" and get this error when trying to retrieve data:

[GilbertQ]

Hi @cstewrun 

I would suggest checking with your Snowflake admin that the calls are getting through to Snowflake?

[cstewrun]

I checked the snowflake logs and there was no failed logins during this time.

[GilbertQ]

So you could see it getting to snowflake with the right user?

[cstewrun · Accepted solution]

For users in the our domain their queries run without issue using their login.  When testing customer access where their email domain would be outside (gmail, etc), those users have a login we can see in snowflake but get credentials error in powerbi.com trying to run a report.  We have tested with all (external and internal) having the same SF roles and default warehouse.  When looking at login attempts we do not see the external test user even attempting to login.