Skip to content

Commit 231f3db

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #196562 from zeinab-mk/zeinam-purview1
Power BI scan
2 parents 7d59ade + 49cb9e8 commit 231f3db

File tree

4 files changed

+456
-189
lines changed

4 files changed

+456
-189
lines changed

‎articles/purview/register-scan-power-bi-tenant-cross-tenant.md

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
---
2+
title: Connect to and manage a Power BI tenant cross tenant
3+
description: This guide describes how to connect to a cross-tenant Power BI tenant in Microsoft Purview, and use Microsoft Purview's features to scan and manage your Power BI tenant source.
4+
author: chanuengg
5+
ms.author: csugunan
6+
ms.service: purview
7+
ms.subservice: purview-data-map
8+
ms.topic: how-to
9+
ms.date: 04/29/2022
10+
ms.custom: template-how-to, ignite-fall-2021
11+
---
12+
13+
# Connect to and manage a Power BI tenant in Microsoft Purview (Cross Tenant)
14+
15+
This article outlines how to register a Power BI tenant in a cross-tenant scenario, and how to authenticate and interact with the tenant in Microsoft Purview. For more information about Microsoft Purview, read the [introductory article](overview.md).
16+
17+
## Supported capabilities
18+
19+
|**Metadata Extraction**| **Full Scan** |**Incremental Scan**|**Scoped Scan**|**Classification**|**Access Policy**|**Lineage**|
20+
|---|---|---|---|---|---|---|
21+
| [Yes](#deployment-checklist)| [Yes](#deployment-checklist)| Yes | No | No | No| [Yes](how-to-lineage-powerbi.md)|
22+
23+
### Supported scenarios for Power BI scans
24+
25+
|**Scenarios** |**Microsoft Purview public access allowed/denied** |**Power BI public access allowed /denied** | **Runtime option** | **Authentication option** | **Deployment checklist** |
26+
|---------|---------|---------|---------|---------|---------|
27+
|Scenario 1 |Allowed |Allowed |Azure runtime |Delegated Authentication | [Deployment checklist](#deployment-checklist) |
28+
|Scenario 2 |Allowed |Allowed |Self-hosted runtime |Delegated Authentication | [Deployment checklist](#deployment-checklist) |
29+
30+
### Known limitations
31+
32+
- For cross-tenant scenario, delegated authentication is only supported option for scanning.
33+
- You can create only one scan for a Power BI data source that is registered in your Microsoft Purview account.
34+
- If Power BI dataset schema is not shown after scan, it is due to one of the current limitations with [Power BI Metadata scanner](/power-bi/admin/service-admin-metadata-scanning).
35+
36+
## Prerequisites
37+
38+
Before you start, make sure you have the following prerequisites:
39+
40+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
41+
42+
- An active [Microsoft Purview account](create-catalog-portal.md).
43+
44+
## Authentication options
45+
46+
- Delegated Authentication
47+
48+
## Deployment checklist
49+
Use any of the following deployment checklists during the setup or for troubleshooting purposes, based on your scenario:
50+
51+
# [Scenario 1](#tab/Scenario1)
52+
53+
### Scan cross-tenant Power BI using Azure IR and Delegated Authentication in public network
54+
55+
1. Make sure Power BI and Microsoft Purview accounts are in cross-tenant.
56+
57+
2. Make sure Power BI tenant Id is entered correctly during the registration. By default, Power BI tenant ID that exists in the same Azure Active Directory as Microsoft Purview will be populated.
58+
59+
3. From Azure portal, validate if Microsoft Purview account Network is set to public access.
60+
61+
4. From Power BI tenant Admin Portal, make sure Power BI tenant is configured to allow public network.
62+
63+
5. Check your Azure Key Vault to make sure:
64+
1. There are no typos in the password.
65+
2. Microsoft Purview Managed Identity has get/list access to secrets.
66+
67+
6. Review your credential to validate:
68+
1. Client ID matches _Application (Client) ID_ of the app registration.
69+
2. Username includes the user principal name such as `[email protected]`.
70+
71+
7. In Power BI Azure AD tenant, validate Power BI admin user settings to make sure:
72+
1. User is assigned to Power BI Administrator role.
73+
2. At least one [Power BI license](/power-bi/admin/service-admin-licensing-organization#subscription-license-types) is assigned to the user.
74+
3. If user is recently created, login with the user at least once to make sure password is reset successfully and user can successfully initiate the session.
75+
4. There is no MFA or Conditional Access Policies are enforced on the user.
76+
77+
8. In Power BI Azure AD tenant, validate App registration settings to make sure:
78+
1. App registration exists in your Azure Active Directory tenant where Power BI tenant is located.
79+
2. Under **API permissions**, the following **delegated permissions** and **grant admin consent for the tenant** is set up with read for the following APIs:
80+
1. Power BI Service Tenant.Read.All
81+
2. Microsoft Graph openid
82+
3. Microsoft Graph User.Read
83+
3. Under **Authentication**:
84+
1. **Supported account types**, **Accounts in any organizational directory (Any Azure AD directory - Multitenant)** is selected.
85+
2. **Implicit grant and hybrid flows**, **ID tokens (used for implicit and hybrid flows)** is selected.
86+
3. **Allow public client flows** is enabled.
87+
88+
# [Scenario 2](#tab/Scenario2)
89+
### Scan cross-tenant Power BI using self-hosted IR and Delegated Authentication in public network
90+
91+
1. Make sure Power BI and Microsoft Purview accounts are in cross-tenant.
92+
93+
2. Make sure Power BI tenant Id is entered correctly during the registration.By default, Power BI tenant ID that exists in the same Azure Active Directory as Microsoft Purview will be populated.
94+
95+
3. From Azure portal, validate if Microsoft Purview account Network is set to public access.
96+
97+
4. From Power BI tenant Admin Portal, make sure Power BI tenant is configured to allow public network.
98+
99+
5. Check your Azure Key Vault to make sure:
100+
1. There are no typos in the password.
101+
2. Microsoft Purview Managed Identity has get/list access to secrets.
102+
103+
6. Review your credential to validate:
104+
1. Client ID matches _Application (Client) ID_ of the app registration.
105+
2. Username includes the user principal name such as `[email protected]`.
106+
107+
8. In Power BI Azure AD tenant, validate Power BI admin user settings to make sure:
108+
1. User is assigned to Power BI Administrator role.
109+
2. At least one [Power BI license](/power-bi/admin/service-admin-licensing-organization#subscription-license-types) is assigned to the user.
110+
3. If user is recently created, login with the user at least once to make sure password is reset successfully and user can successfully initiate the session.
111+
4. There is no MFA or Conditional Access Policies are enforced on the user.
112+
113+
9. In Power BI Azure AD tenant, validate App registration settings to make sure:
114+
5. App registration exists in your Azure Active Directory tenant where Power BI tenant is located.
115+
6. Under **API permissions**, the following **delegated permissions** and **grant admin consent for the tenant** is set up with read for the following APIs:
116+
1. Power BI Service Tenant.Read.All
117+
2. Microsoft Graph openid
118+
3. Microsoft Graph User.Read
119+
7. Under **Authentication**:
120+
1. **Supported account types**, **Accounts in any organizational directory (Any Azure AD directory - Multitenant)** is selected.
121+
2. **Implicit grant and hybrid flows**, **ID tokens (used for implicit and hybrid flows)** is selected.
122+
3. **Allow public client flows** is enabled.
123+
124+
10. Validate Self-hosted runtime settings:
125+
8. Latest version of [Self-hosted runtime](https://www.microsoft.com/download/details.aspx?id=39717) is installed on the VM.
126+
9. Network connectivity from Self-hosted runtime to Power BI tenant is enabled.
127+
10. Network connectivity from Self-hosted runtime to Microsoft services is enabled.
128+
11. [JDK 8 or later](https://www.oracle.com/java/technologies/javase-jdk11-downloads.html) is installed.
129+
130+
---
131+
132+
## Register Power BI tenant
133+
134+
1. Select the **Data Map** on the left navigation.
135+
136+
1. Then select **Register**.
137+
138+
Select **Power BI** as your data source.
139+
140+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/select-power-bi-data-source.png" alt-text="Image showing the list of data sources available to choose.":::
141+
142+
1. Give your Power BI instance a friendly name. The name must be between 3-63 characters long and must contain only letters, numbers, underscores, and hyphens. Spaces aren't allowed.
143+
144+
1. Edit the Tenant ID field to replace with cross Power BI tenant you want to register and scan. By default, Power BI tenant ID that exists in the same Azure Active Directory as Microsoft Purview will be populated.
145+
146+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/register-cross-tenant.png" alt-text="Image showing the registration experience for cross tenant Power BI":::
147+
148+
## Scan cross-tenant Power BI
149+
150+
### Scan cross-tenant Power BI using Delegated authentication
151+
152+
Delegated authentication is the only supported option for cross-tenant scan option, however, you can use either Azure runtime or a self-hosted integration runtime to run a scan.
153+
154+
To create and run a new scan using Azure runtime, perform the following steps:
155+
156+
1. Create a user account in Azure Active Directory tenant where Power BI tenant is located and assign the user to Azure Active Directory role, **Power BI Administrator**. Take note of username and login to change the password.
157+
158+
2. Assign proper Power BI license to the user.
159+
160+
2. Navigate to your Azure key vault in the tenant where Microsoft Purview is created.
161+
162+
3. Select **Settings** > **Secrets** and select **+ Generate/Import**.
163+
164+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-key-vault.png" alt-text="Screenshot how to navigate to Azure Key Vault.":::
165+
166+
5. Enter a name for the secret and for **Value**, type the newly created password for the Azure AD user. Select **Create** to complete.
167+
168+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-key-vault-secret.png" alt-text="Screenshot how to generate an Azure Key Vault secret.":::
169+
170+
6. If your key vault is not connected to Microsoft Purview yet, you will need to [create a new key vault connection](manage-credentials.md#create-azure-key-vaults-connections-in-your-microsoft-purview-account)
171+
172+
7. Create an App Registration in your Azure Active Directory tenant where Power BI is located. Provide a web URL in the **Redirect URI**. Take note of Client ID(App ID).
173+
174+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-create-service-principle.png" alt-text="Screenshot how to create a Service Principle.":::
175+
176+
8. From Azure Active Directory dashboard, select newly created application and then select **App permissions**. Assign the application the following delegated permissions and grant admin consent for the tenant:
177+
178+
- Power BI Service Tenant.Read.All
179+
- Microsoft Graph openid
180+
- Microsoft Graph User.Read
181+
182+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-delegated-permissions.png" alt-text="Screenshot of delegated permissions for Power BI Service and Microsoft Graph.":::
183+
184+
9. From Azure Active Directory dashboard, select newly created application and then select **Authentication**. Under **Supported account types** select **Accounts in any organizational directory (Any Azure AD directory - Multitenant)**.
185+
186+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-multitenant.png" alt-text="Screenshot of account type support multitenant.":::
187+
188+
10. Under **Implicit grant and hybrid flows**, ensure to select **ID tokens (used for implicit and hybrid flows)**
189+
190+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-id-token-hybrid-flows.png" alt-text="Screenshot of ID token hybrid flows.":::
191+
192+
11. Under **Advanced settings**, enable **Allow Public client flows**.
193+
194+
12. In the Microsoft Purview Studio, navigate to the **Data map** in the left menu. Navigate to **Sources**.
195+
196+
13. Select the registered Power BI source from cross tenant.
197+
198+
14. Select **+ New scan**.
199+
200+
15. Give your scan a name. Then select the option to include or exclude the personal workspaces.
201+
202+
> [!Note]
203+
> Switching the configuration of a scan to include or exclude a personal workspace will trigger a full scan of PowerBI source.
204+
205+
16. Select **Azure AutoResolveIntegrationRuntime** from the drop-down list.
206+
207+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-scan-cross-tenant.png" alt-text="Image showing Power BI scan setup using Azure IR for cross tenant.":::
208+
209+
17. For the **Credential**, select **Delegated authentication** and click **+ New** to create a new credential.
210+
211+
18. Create a new credential and provide required parameters:
212+
213+
- **Name**: Provide a unique name for credential.
214+
215+
- **Client ID**: Use Service Principal Client ID (App ID) you created earlier.
216+
217+
- **User name**: Provide the username of Power BI Administrator you created earlier.
218+
219+
- **Password**: Select the appropriate Key vault connection and the **Secret name** where the Power BI account password was saved earlier.
220+
221+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-scan-delegated-authentication.png" alt-text="Image showing Power BI scan setup using Delegated authentication.":::
222+
223+
19. Select **Test Connection** before continuing to next steps.
224+
225+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/power-bi-scan-cross-tenant-test.png" alt-text="Screenshot of test connection status.":::
226+
227+
If **Test Connection** failed, select **View Report** to see the detailed status and troubleshoot the problem:
228+
229+
1. Access - Failed status means the user authentication failed: Validate if username and password is correct. review if the Credential contains correct Client (App) ID from the App Registration.
230+
2. Assets (+ lineage) - Failed status means the Microsoft Purview - Power BI authorization has failed. Make sure the user is added to Power BI Administrator role and has proper Power BI license assigned to.
231+
3. Detailed metadata (Enhanced) - Failed status means the Power BI admin portal is disabled for the following setting - **Enhance admin APIs responses with detailed metadata**
232+
233+
20. Set up a scan trigger. Your options are **Recurring**, and **Once**.
234+
235+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/scan-trigger.png" alt-text="Screenshot of the Microsoft Purview scan scheduler.":::
236+
237+
18. On **Review new scan**, select **Save and run** to launch your scan.
238+
239+
:::image type="content" source="media/setup-power-bi-scan-catalog-portal/save-run-power-bi-scan.png" alt-text="Screenshot of Save and run Power BI source.":::
240+
241+
## Troubleshooting tips
242+
243+
If delegated auth is used:
244+
- Check your key vault. Make sure there are no typos in the password.
245+
- Assign proper [Power BI license](/power-bi/admin/service-admin-licensing-organization#subscription-license-types) to Power BI administrator user.
246+
- Validate if user is assigned to Power BI Administrator role.
247+
- If user is recently created, make sure password is reset successfully and user can successfully initiate the session.
248+
249+
## Next steps
250+
251+
Now that you have registered your source, follow the below guides to learn more about Microsoft Purview and your data.
252+
253+
- [Data insights in Microsoft Purview](concept-insights.md)
254+
- [Lineage in Microsoft Purview](catalog-lineage-user-guide.md)
255+
- [Search Data Catalog](how-to-search-catalog.md)

‎articles/purview/register-scan-power-bi-tenant-troubleshoot.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: Troubleshoot Power BI tenant scans
3+
description: This guide describes how to troubleshoot Power BI tenant scans in Microsoft Purview.
4+
author: zeinam
5+
ms.author: zeinam
6+
ms.service: purview
7+
ms.subservice: purview-data-map
8+
ms.topic: how-to
9+
ms.date: 04/29/2022
10+
ms.custom: template-how-to, ignite-fall-2021
11+
---
12+
13+
# Troubleshoot Power BI tenant scans in Microsoft Purview
14+
15+
This article explores common troubleshooting methods for scanning Power BI tenants in [Microsoft Purview](overview.md).
16+
17+
## Supported capabilities
18+
19+
|**Metadata Extraction**| **Full Scan** |**Incremental Scan**|**Scoped Scan**|**Classification**|**Access Policy**|**Lineage**|
20+
|---|---|---|---|---|---|---|
21+
| [Yes](register-scan-power-bi-tenant.md#deployment-checklist)| [Yes](register-scan-power-bi-tenant.md#deployment-checklist)| Yes | No | No | No| [Yes](how-to-lineage-powerbi.md)|
22+
23+
## Error code: Test connection failed - AASDST50079
24+
25+
- **Message**: `Failed to get access token with given credential to access Power BI tenant. Authentication type PowerBIDelegated Message: AASDST50079 Due to a configuration change made by your administrator or because you moved to a new location, you must enroll in multi-factor authentication.`
26+
27+
- **Cause**: Authentication is interrupted, due multi-factor authentication requirement for the Power BI admin user.
28+
29+
- **Recommendation**: Disable multi-factor authentication requirement and exclude user from conditional access policies. Login with the user to Power BI dashboard to validate if user can successfully login to the application.
30+
31+
## Error code: Test connection failed - AASTS70002
32+
33+
- **Message**: `Failed to access token with given credential to access Power BI tenant. Authentication type: PowerBiDelegated Message AASTS70002: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.`
34+
35+
- **Cause**: If Delegated Authentication is used, the problem could be a misconfiguration on the app registration.
36+
37+
- **Recommendation**: Review Power BI deployment checklist based on your scenario.
38+
39+
## Error code: Test connection failed - Detailed metadata
40+
41+
- **Message**: `Failed to enable the PowerBI administrator API to fetch basic metadata and lineage.`
42+
43+
- **Cause**: **Allow service principals to use read-only Power BI admin APIs** is disabled.
44+
45+
- **Recommendation**: Under Power BI Admin portal, enable **Allow service principals to use read-only Power BI admin APIs**.
46+
47+
## Issue: Test Connection succeeded. No assets discovered.
48+
49+
- **Message**: N/A
50+
51+
- **Cause**: This problem can occur in same-tenant or cross-tenant scenarios, due problem with networking or authentication issues.
52+
53+
- **Recommendation**:
54+
- If Delegated Authentication is used, validate Power BI Admin user sign in logs in Azure Active Directory logs to make sure user sign in is successful. Login with the user to Power BI dashboard to validate if user can successfully login to the application.
55+
56+
- Review your network configurations. Private endpoint is required for **both** Power BI tenant and Purview account, if one of these services (Power BI tenant or Microsoft Purview) is configured to block public access.
57+
58+
## Next steps
59+
60+
Follow the below guides to learn more about Microsoft Purview and your data.
61+
62+
- [Data insights in Microsoft Purview](concept-insights.md)
63+
- [Lineage in Microsoft Purview](catalog-lineage-user-guide.md)
64+
- [Search Data Catalog](how-to-search-catalog.md)

0 commit comments

Comments
 (0)