|
| 1 | +--- |
| 2 | +title: Use Managed Identity to authenticate your Azure Stream Analytics job to Power BI output (Preview) |
| 3 | +description: This article describes how to use managed identities to authenticate your Azure Stream Analytics job to Power BI output. |
| 4 | +author: cedarbaum |
| 5 | +ms.author: sacedarb |
| 6 | +ms.service: stream-analytics |
| 7 | +ms.topic: conceptual |
| 8 | +ms.date: 10/31/2019 |
| 9 | +--- |
| 10 | + |
| 11 | +# Use Managed Identity to authenticate your Azure Stream Analytics job to Power BI (Preview) |
| 12 | + |
| 13 | +[Managed Identity authentication](../active-directory/managed-identities-azure-resources/overview.md) for output to Power BI is available for Azure Stream Analytics as a preview. This gives Stream Analytics jobs direct access to a workspace within your Power BI account. This feature allows for deployments of Stream Analytics jobs to be fully automated, since it is no longer required for a user to interactively log in to Power BI via the Azure portal. Additionally, long running jobs that write to Power BI are now better supported, since you will not need to periodically reauthorize the job. |
| 14 | + |
| 15 | +This article shows you how to enable Managed Identity for the Power BI output(s) of a Stream Analytics job through the Azure portal and through an Azure Resource Manager deployment. |
| 16 | + |
| 17 | +## Prerequisites |
| 18 | + |
| 19 | +The following are required for using this feature: |
| 20 | + |
| 21 | +- A Power BI account with a [Pro license](https://docs.microsoft.com/power-bi/service-admin-purchasing-power-bi-pro). |
| 22 | + |
| 23 | +- An upgraded workspace within your Power BI account. See [Power BI's announcement](https://powerbi.microsoft.com/blog/announcing-new-workspace-experience-general-availability-ga/) of this feature for more details. |
| 24 | + |
| 25 | +## Create a Stream Analytics job using the Azure portal |
| 26 | + |
| 27 | +1. Create a new Stream Analytics job or open an existing job in the Azure portal. From the menu bar located on the left side of the screen, select **Managed Identity** located under **Configure**. Ensure that "Use System-assigned Managed Identity" is selected and then select the **Save** button on the bottom of the screen. |
| 28 | + |
| 29 | +  |
| 30 | + |
| 31 | +2. Before configuring the output, give the Stream Analytics job access to your Power BI workspace by following the directions in the [Give the Stream Analytics job access to your Power BI workspace](#give-the-stream-analytics-job-access-to-your-power-bi-workspace) section of this article. |
| 32 | + |
| 33 | +3. Navigate to the **Outputs** section of your Stream Analytic's job, select **+ Add**, and then choose **Power BI**. Then, select the **Authorize** button and log in with your Power BI account. |
| 34 | + |
| 35 | +  |
| 36 | + |
| 37 | +4. Once authorized, a dropdown list will be populated with all of the workspaces you have access to. Select the workspace that you authorized in the previous step. Then select **Managed Identity** as the "Authentication mode". Finally, select the **Save** button. |
| 38 | + |
| 39 | +  |
| 40 | + |
| 41 | +## Azure Resource Manager deployment |
| 42 | + |
| 43 | +Azure Resource Manager allows you to fully automate the deployment of your Stream Analytics job. You can deploy Resource Manager templates using either Azure PowerShell or the [Azure CLI](https://docs.microsoft.com/cli/azure/?view=azure-cli-latest). The below examples use the Azure CLI. |
| 44 | + |
| 45 | + |
| 46 | +1. You can create a **Microsoft.StreamAnalytics/streamingjobs** resource with a Managed Identity by including the following property in the resource section of your Resource Manager template: |
| 47 | + |
| 48 | + ```json |
| 49 | + "identity": { |
| 50 | + "type": "SystemAssigned", |
| 51 | + } |
| 52 | + ``` |
| 53 | + |
| 54 | + This property tells Azure Resource Manager to create and manage the identity for your Stream Analytics job. Below is an example Resource Manager template that deploys a Stream Analytics job with Managed Identity enabled and a Power BI output sink that uses Managed Identity: |
| 55 | + |
| 56 | + ```json |
| 57 | + { |
| 58 | + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", |
| 59 | + "contentVersion": "1.0.0.0", |
| 60 | + "resources": [ |
| 61 | + { |
| 62 | + "apiVersion": "2017-04-01-preview", |
| 63 | + "name": "pbi_managed_id", |
| 64 | + "location": "[resourceGroup().location]", |
| 65 | + "type": "Microsoft.StreamAnalytics/StreamingJobs", |
| 66 | + "identity": { |
| 67 | + "type": "systemAssigned" |
| 68 | + }, |
| 69 | + "properties": { |
| 70 | + "sku": { |
| 71 | + "name": "standard" |
| 72 | + }, |
| 73 | + "outputs":[ |
| 74 | + { |
| 75 | + "name":"output", |
| 76 | + "properties":{ |
| 77 | + "datasource":{ |
| 78 | + "type":"PowerBI", |
| 79 | + "properties":{ |
| 80 | + "dataset": "dataset_name", |
| 81 | + "table": "table_name", |
| 82 | + "groupId": "01234567-89ab-cdef-0123-456789abcdef", |
| 83 | + "authenticationMode": "Msi" |
| 84 | + } |
| 85 | + } |
| 86 | + } |
| 87 | + } |
| 88 | + ] |
| 89 | + } |
| 90 | + } |
| 91 | + ] |
| 92 | + } |
| 93 | + ``` |
| 94 | + |
| 95 | + Deploy the job above to the Resource group **ExampleGroup** using the below Azure CLI command: |
| 96 | + |
| 97 | + ```azurecli |
| 98 | + az group deployment create --resource-group ExampleGroup -template-file StreamingJob.json |
| 99 | + ``` |
| 100 | + |
| 101 | +2. After the job is created, use Azure Resource Manager to retrieve the job's full definition. |
| 102 | + |
| 103 | + ```azurecli |
| 104 | + az resource show --ids /subscriptions/<subsription-id>/resourceGroups/<resource-group>/providers/Microsoft.StreamAnalytics/StreamingJobs/<resource-name> |
| 105 | + ``` |
| 106 | + |
| 107 | + The above command will return a response like the below: |
| 108 | + |
| 109 | + ```json |
| 110 | + { |
| 111 | + "id": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.StreamAnalytics/streamingjobs/<resource-name>", |
| 112 | + "identity": { |
| 113 | + "principalId": "<principal-id>", |
| 114 | + "tenantId": "<tenant-id>", |
| 115 | + "type": "SystemAssigned", |
| 116 | + "userAssignedIdentities": null |
| 117 | + }, |
| 118 | + "kind": null, |
| 119 | + "location": "West US", |
| 120 | + "managedBy": null, |
| 121 | + "name": "<resource-name>", |
| 122 | + "plan": null, |
| 123 | + "properties": { |
| 124 | + "compatibilityLevel": "1.0", |
| 125 | + "createdDate": "2019-07-12T03:11:30.39Z", |
| 126 | + "dataLocale": "en-US", |
| 127 | + "eventsLateArrivalMaxDelayInSeconds": 5, |
| 128 | + "jobId": "<job-id>", |
| 129 | + "jobState": "Created", |
| 130 | + "jobStorageAccount": null, |
| 131 | + "jobType": "Cloud", |
| 132 | + "outputErrorPolicy": "Stop", |
| 133 | + "package": null, |
| 134 | + "provisioningState": "Succeeded", |
| 135 | + "sku": { |
| 136 | + "name": "Standard" |
| 137 | + } |
| 138 | + }, |
| 139 | + "resourceGroup": "<resource-group>", |
| 140 | + "sku": null, |
| 141 | + "tags": null, |
| 142 | + "type": "Microsoft.StreamAnalytics/streamingjobs" |
| 143 | + } |
| 144 | + ``` |
| 145 | + |
| 146 | + If you plan to use Power BI's REST API to add the Stream Analytics job to your Power BI workspace, make note of the returned "principalId". |
| 147 | + |
| 148 | +3. Now that the job is created, continue to the [Give the Stream Analytics job access to your Power BI workspace](#give-the-stream-analytics-job-access-to-your-power-bi-workspace) section of this article. |
| 149 | + |
| 150 | + |
| 151 | +## Give the Stream Analytics job access to your Power BI workspace |
| 152 | + |
| 153 | +Now that the Stream Analytics job has been created, it can be given access to a Power BI workspace. |
| 154 | + |
| 155 | +### Use the Power BI UI |
| 156 | + |
| 157 | + > [!Note] |
| 158 | + > In order to add the Stream Analytics job to your Power BI workspace using the UI, you also have to enable service principal access in the **Developer settings** in the Power BI admin portal. See [Get started with a service principal](https://docs.microsoft.com/power-bi/developer/embed-service-principal#get-started-with-a-service-principal) for more details. |
| 159 | + |
| 160 | +1. Navigate to the workspace's access settings. See this article for more details: [Give access to your workspace](https://docs.microsoft.com/power-bi/service-create-the-new-workspaces#give-access-to-your-workspace). |
| 161 | + |
| 162 | +2. Type the name of your Stream Analytics job in the text box and select **Contributor** as the access level. |
| 163 | + |
| 164 | +3. Select **Add** and close the pane. |
| 165 | + |
| 166 | +  |
| 167 | + |
| 168 | +### Use the Power BI REST API |
| 169 | + |
| 170 | +The Stream Analytics job can also be added as a Contributor to the workspace by using the "Add Group User" REST API directly. Full documentation for this API can be found here: [Groups - Add Group User](https://docs.microsoft.com/rest/api/power-bi/groups/addgroupuser). |
| 171 | + |
| 172 | +**Sample Request** |
| 173 | +```http |
| 174 | +POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/users |
| 175 | +``` |
| 176 | +Request Body |
| 177 | +```json |
| 178 | +{ |
| 179 | + "groupUserAccessRight": "Contributor", |
| 180 | + "identifier": "<principal-id>", |
| 181 | + "principalType": "App" |
| 182 | +} |
| 183 | +``` |
| 184 | + |
| 185 | +## Limitations |
| 186 | +Below are the limitations of this feature: |
| 187 | + |
| 188 | +- Classic Power BI workspaces are not supported. |
| 189 | + |
| 190 | +- Azure accounts without Azure Active Directory. |
| 191 | + |
| 192 | +- Multi-tenant access is not supported. The Service principal created for a given Stream Analytics job must reside in the same Azure Active Directory tenant in which the job was created, and cannot be used with a resource that resides in a different Azure Active Directory tenant. |
| 193 | + |
| 194 | +- [User Assigned Identity](../active-directory/managed-identities-azure-resources/overview.md) is not supported. This means you are not able to enter your own service principal to be used by their Stream Analytics job. The service principal must be generated by Azure Stream Analytics. |
| 195 | + |
| 196 | +## Next steps |
| 197 | + |
| 198 | +* [Power BI dashboard integration with Azure Stream Analytics](./stream-analytics-power-bi-dashboard.md) |
| 199 | +* [Understand outputs from Azure Stream Analytics](./stream-analytics-define-outputs.md) |
0 commit comments