Using service principal for the datasource credentials

[oyermokhin]

Hi!

I use service principal to connect from PowerBI service to Azure Data Explorer (direct query mode). Pbix is file uploaded to service via power shell. After that I get oauth2 access token for my service principal and set it to the datasource with a help of https://docs.microsoft.com/en-us/rest/api/power-bi/gateways/update-datasource#credentialdetails

Everything works fine exepct that max lifetime for the access token that I can get is 1 day. So after that my reports get unauthorized errorr. I can't find a way to provide refresh token to datasource and it is not clear if it is supported anyhow. 

Is there any workaround to use service principal? 

Thanks in advance!

[daanjjansen]

Im having the exact same issue. Anybody found a workarround for this?
Ive tried to use a refresh token instead of an accesstoken, which lifetime could be longer.. However this does not seem to be supported

[stefan_c2d]

@v-jayw-msft I'm currently facing the same issue. The reason why the token is only valid for one day/hour is that when you manually set the OAUTH access token for your datasource (which you apparently need to do for an SP), it will use this token until it expired. I would like to know what's the difference how the credentials are set when you use a normal user account where the token refreshes automaticall.

@oyermokhin did you ever solve this problem?

[oyermokhin]

I use following method to set datasource credentials - https://docs.microsoft.com/en-us/rest/api/power-bi/gateways/update-datasource

$patchBody = @{ "credentialDetails" = @{ "credentials" = "{""credentialData"":[{""name"":""accessToken"",""value"":""$AccessToken""}]}" "credentialType" = "OAuth2" "encryptedConnection" = "NotEncrypted" "encryptionAlgorithm" = "None" "privacyLevel" = "Private" } }

 The AccessToken I get using following code

$requestAccessTokenUri = "https://login.microsoftonline.com/$Dataset_TenantId/oauth2/token"; $body = "grant_type=client_credentials&client_id=$Dataset_ClientId&client_secret=$Dataset_ClientSecret&resource=$KustoClusterUrl" $token = Invoke-RestMethod -Method Post -Uri $requestAccessTokenUri -Body $body -ContentType 'application/x-www-form-urlencoded'

This token is valid only for 1 hour, I can set it to be valid for 23h 59m using token lifetime policy, but after that my report will stop working
 
I know that other azure services also accept refresh token, so they can issues new access token automatically, but I can't provide refresh token to powerbi
 

[v-jayw-msft]

Hi @oyermokhin ,

Why the lifetime for the access token is only 1 day? And have you checked this document?

https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal 

Best Regards,

Jay