Using service account for scheduled refresh

[guyatisk]

Can someone direct me on how to use a service account (or an AD account that we have set up as a generic shared account with an E5 license) to schedule refreshes for datasets in a workspace.  When someone is creating a power bi report under their own user AD account (all in our org have E5 licenses) and then publishes to a workspace designated for them to publish to (not my workspace), is it that ID that "drives" processing of the report?  Or where in the report creation can the SA account be used?  Does a creator need to be signed in as that SA account?  Many questions surrounding SDLC and using Power BI.  I appreciate any help, advice, links to best practices, etc.

[edhans]

The owner of the dataset can schedule the refresh. If someone else wants to do it, they will have to take it over in the dataset settings.

Whomever owns it must sign in to all datasources unless those data sources are managed by a gateway. If you want to manage even cloud datasources (Sharepoint lists for example) that way, you just need to set them up in an on prem gateway and give the report authors permissions to use the gateway. 

I wouldn't use a "service account" because you'd have to share that login info with the dataset owner. The gateway is the best way to go here I believe.

[guyatisk]

Thanks for the response, I appreciate it.  I think the reason this question came up is because when a user has to change their password every 90 days, it tends to break Power BI reports and it seems to be a challenge to reestablish those data connections, for some reason.  The thought was just to use a generic account whose password is complex, but also is set to never expire.

[edhans]

Well, no user passwords should ever expire. NIST changed their guidance years ago on this and essentially admitted the "change regularly" was a made up standard.
NIST’s New Password Rule Book: Updated Guidelines Offer Benefits and Risk (isaca.org)
The New NIST Guidelines: We Had It All Wrong Before (riskcontrolstrategies.com)

And Microsoft also recommends against changing passwords unless there is evidence the password was compromised.
Password policy recommendations - Microsoft 365 admin | Microsoft Learn

[guyatisk]

LOL!  Easier said then done.  I could bring this to IT management, but I already know what their answer would be.  I worked at another similar company who made users change to a minumum 15-character password and set them to never expire.  But the password had to be at least 15 characters long.  I proposed this already and it was struck down.  (Healthcare industry)

[edhans]

Yeah, old habits die hard, and changing passwords seems common sense, but it is actually detrimental.

That said, when you connect to a Power BI Dataset, the password isn't stored, it is a token, and those will periodically expire, but they don't outright break when a user changes their password. The only time I've seen it break immediatly is when a user turns on or off 2 factor authentication. That will kill the token immediately.