Forum Discussion
Using service account for scheduled refresh
The owner of the dataset can schedule the refresh. If someone else wants to do it, they will have to take it over in the dataset settings.
Whomever owns it must sign in to all datasources unless those data sources are managed by a gateway. If you want to manage even cloud datasources (Sharepoint lists for example) that way, you just need to set them up in an on prem gateway and give the report authors permissions to use the gateway.
I wouldn't use a "service account" because you'd have to share that login info with the dataset owner. The gateway is the best way to go here I believe.
Thanks for the response, I appreciate it. I think the reason this question came up is because when a user has to change their password every 90 days, it tends to break Power BI reports and it seems to be a challenge to reestablish those data connections, for some reason. The thought was just to use a generic account whose password is complex, but also is set to never expire.
Well, no user passwords should ever expire. NIST changed their guidance years ago on this and essentially admitted the "change regularly" was a made up standard.
NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk (isaca.org)
The New NIST Guidelines: We Had It All Wrong Before (riskcontrolstrategies.com)
And Microsoft also recommends against changing passwords unless there is evidence the password was compromised.
Password policy recommendations - Microsoft 365 admin | Microsoft LearnLOL! Easier said then done. I could bring this to IT management, but I already know what their answer would be. I worked at another similar company who made users change to a minumum 15-character password and set them to never expire. But the password had to be at least 15 characters long. I proposed this already and it was struck down. (Healthcare industry)
Yeah, old habits die hard, and changing passwords seems common sense, but it is actually detrimental.
That said, when you connect to a Power BI Dataset, the password isn't stored, it is a token, and those will periodically expire, but they don't outright break when a user changes their password. The only time I've seen it break immediatly is when a user turns on or off 2 factor authentication. That will kill the token immediately.