Using a Dataflow connector with different credentials

[zantarel]

Hi all 

I'm trying to pull the same information from multiple different Azure Tenants using an Azure Resource Graph Connector (i.e. a list of active subscriptions). Unfortunately, it seems like there is only one ARG connector for me as a user. So even though I'm using different workspaces, every time I change the credential on one dataflow, it changes it on all of them ... and makes the credential is the same across all the workspaces.  Which makes it impossible to create a datflow for each tenant, all of which use different credentials. 

Even changing the scope of the connector doesn't appear to let me use a different credential to the one with no scope.

I can't be the only person who is trying to pull information from multiple Azure Tenants into one centralised tenant?? How is everyone else doing this? 

Thanks in advance!! 

[zantarel · Accepted solution]

Hi everyone, so Microsoft support have come back and have basically said that in order to do this, I either need to use an on-prem gateway .... for an Azure source... I'm not sure they fully understood the ticket, but ok. 

OR use the Dataflow Gen 2 instead of Gen 1.  I don't have a license for the Gen 2, so that isn't going to work for me and I don't know if I'll be able to get the company to pay for it.   

I have been looking at the composite models and I may have a way around it with multiple semantic models - one model for each tenant, and then combining those potentially. It won't be a 'clean' way of doing it, but I think it might just work - because I can set the credentials for each semantic model using the method @GilbertQ  mentioned above - creating the creds first. 

[v-sathmakuri]

Hi @zantarel ,

Please let us know if you have any other question, we will be happy to address. If any of the response helped in addressing you query kindly accept it as solution.

Thank you!!

[v-sathmakuri]

Hi @zantarel ,

Thank you for reaching out to Microsoft Fabric Community.

Thank you @Poojara_D12  and @GilbertQ  for the prompt response.

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you!!

[zantarel]

Hi

So far nothing has worked. I got pretty close with @GilbertQ  idea - but the only way I could do that would be to create a semantic model for each tenant, and then probably write a powerAutomate flow to scrape that data into something a dataflow could consume in order to get to the end goal of having all subscriptions and tenants in one semantic model ... Of course, if we could combine different semantic models (which is on the roadmap) that would remove the need for PowerAutomate to scrape the data.  As it is, I am investigating using Fabric within the organisation and have a ticket open with Support about this.  Will update when I hear anything useful. 

[sergej_og]

Gilbert's proposal should work out if you use the web connector instead of the native ARG connector.
Create for every tenant a connection and choose those in your dataflow.
That's how I would try to proceed

[zantarel]

What do you mean by the 'web connector'? 

[v-sathmakuri]

Hi @zantarel ,

Thank you for the update, please let us know if you have any further queries, we are happy to address.

Thank you!!

[Poojara_D12]

Hi @zantarel 

You're not alone in facing this limitation—many users encounter the same issue when trying to pull data from multiple Azure Tenants using the Azure Resource Graph (ARG) connector in Power BI. The root of the problem is that the ARG connector maintains a single global credential binding per user across all workspaces, which means any time you update the credentials for one dataflow, it affects all others using the same connector—even if they're in different workspaces. This behavior makes it impossible to maintain separate ARG dataflows for each tenant when different credentials are required. As a result, most organizations avoid using the ARG connector directly in Power BI for multi-tenant setups. Instead, they typically handle this by using Azure Functions, Logic Apps, or Azure Data Factory to authenticate into each tenant using dedicated service principals, perform the ARG queries externally, and store the results in a centralized location like Azure Data Lake or Blob Storage. Power BI then connects to this central repository to retrieve data. Alternatively, some use PowerShell scripts or custom APIs to manage tenant-level data collection and consolidate the results for reporting. These approaches decouple authentication and data retrieval from Power BI, providing more control and scalability in multi-tenant scenarios.

[zantarel]

Hey, ok so that's interesting. I was thinking about using a custom API to be honest. However, I had another thought yesterday, which was as I'm using a service account per tenant, I could get other people in my team to create a dataflow for the other tenants - not ideal, but manageable - as long as we don't have more tenants than people in the team!! However, when I got my colleague to do this, the dataflow he created, with the other credentials overwrote my credentials. So it's not per user. I don't know what it is at this point. But it seems wild to me that someone else can create a dataflow and overwrite my credentials in my dataflow?!

Any recommendations on blogs/videos of people who have created custom APIs for the tenant info? I'm not great at APIs!!

[GilbertQ]

Hi @zantarel 

What happens if you first go and create the connection as a cloud data source, which you will then allow you to pick it as a source when interacting with the different azure subscriptions?

Create and share cloud data sources in the Power BI service - Power BI | Microsoft Learn

[zantarel]

Oh, well now, this is a game changer... I didn't know you could do this and I will have to experiment. I am in a position where I chose dataflows as my avenue to get Azure data into PowerBI because I want to be able to push those dataflows off to other teams - i.e. the backup data can go to the platform team, the list of resources would go to security and the CMDB team etc.  but it looks like I can make the connection available to different semantic models which is interesting ... Thanks for this - I'll go and see if I can get this working!

Edit: This didn't work... so this gives the same behaviour whether I used two dataflows or connected the ARG to the semantic model directly. When I go to edit the semantic model to switch it over to the connection as demonstrated in the link you gave me, there's only one ARG connector. I only see one of these: 

even though there's two queries in the model. So I can still assign the connection to use one set of the credentials, but it'll use the same credential for both queries. 

However, this has given me the idea that I can create multiple semantic models - one for each tenant, using the ARG connection for each tenant I've created this way, and the write PowerAutomate flows to scrape the data from each powerBI report. It's horrid and clunky and nasty... but doable. In theory.  

I have reached out to a few people at MS through my company to see if I can just confirm there is no better way. This is crazy to me - it seems like such a simple thing to be able to do ... !