Forum Discussion
Helper IIWhat to do when developers leave an organization?
An organization has several Power BI report authors and publishers. Data sources range from on-premises databases to files stored in many, many (I repeat, many) different SharePoint document libraries. For the databases, they have gateway data sources that connect via service accounts.
Currently, semantic model connections to SharePoint files in the Service are configured using the corresponding publisher's credentials (via OAuth2).
What's an enterprise solution to avoid refresh problems when publishers leave the organization?
The API allows that in a very convoluted way ( you need to run multiple calls in a specific sequence) but that is missing the point. The employee leaving should be an inflection point and and opportunity to review if these datasets are still needed or can be retired.
Easiest way would be the new Admin of the wrokspace takes over the semantic model and configure credentials.
Hey asocorrocognex ,
we consider it never a good idea to use a personal account for data refresh. When a report is published to a workspace, the re-authentication has to happen. My recommendation is to use a service account. Even when the report is published again, the refresh is using the service account. Takeover is only required when a new schedule has to be configured.
Regards,
Tom
8 Replies
- TomMartens
Super User
Hey asocorrocognex ,
first of all, check your documentation, the minimum documentation is that each semantic model's data sources must be documented.
- who is the owner of the data source
- what is the account used to connect to the data source
- who knows the password of the account
From a governance perspective the use of personal accounts should not be allowed. This means even when connecting to a SharePoint library or a SharePoint list a non-personal acocunt should be used, of course this account requires a license assigned that allows to access the content in SharePoint. This account is only used to access the data sources, this account is not used to create Power BI content, for this reason this account does not require a Power BI Pro licencse.
Hopefully, this helps to tackle your challenge.
Regards,
Tom
- lbendlin
To add - in our company we have a mandate that each workspace must have at least two valid admins (people, not PDLs) at all times. We even remove workspaces from Premium if that is not done despite our mandate.
It is not a technical limitation at all (tenant admins can access orphaned workspaces) but it helps to drive home the BCP part.
asocorrocognexThanks, TomMartens and lbendlin--I agree with your process and technical suggestions. The challenge here is that there are dozens of reports connecting to very many SharePoint document libraries. For context, each department (e.g. Finance, Operations, etc.) has its own document library. It then becomes impractical to have an admin create a service account to connect to each library. There could be a global service account with access to all document libraries, but that would be too powerful to give to report publishers. The double admin idea is solid but refreshes would still fail if a publisher leaves the company.
Another proposal is to run a script to replace all data source credentials for the exiting employee with the credentials of the employee who will be taking over the semantic models, etc. However, I am not certain if the API allows this for all artifacts.
- lbendlin
The API allows that in a very convoluted way ( you need to run multiple calls in a specific sequence) but that is missing the point. The employee leaving should be an inflection point and and opportunity to review if these datasets are still needed or can be retired.
Hi asocorrocognex ,
I believe TomMartens , aj1973 and lbendlin 's replies were very useful and helped you in some way. May I ask if your problem has been solved? You might consider marking the helpful replies as solutions. Feel free to keep asking us questions if you still have doubts.
Best Regards,
Ada Wang
