# Power BI Data Source Authentication Configuration
URL: https://docs.valsight.ai/power-bi-data-source-authentication-configuration/
Description: Set up Microsoft Entra ID, Power BI and Valsight so that projects can create Power BI data sources.
## Goal

Projects on your Valsight installation can create [Power BI data sources](/power-bi-data-source/). The **Power BI** data source type appears once a Power BI client registration is configured.

Valsight reads Power BI as the user who starts an import, shown to users as **Your own Power BI account**. Each user signs in with their Microsoft account and sees what they can see in Power BI, row-level security included. No Power BI admin setting beyond the defaults is needed. Imports are always started by a user; Valsight does not schedule them.

> **Valsight cloud customers:** carry out steps 1 to 3 in your own Microsoft tenant, then send Valsight the **Directory (tenant) ID**, the **Application (client) ID** and the **client secret value** over a secure channel, with the secret's expiry date. Valsight configures your instance (step 4). For the redirect URI in step 1, use your instance address, for example `https://<instance>.valsight.cloud/authorized/powerbiDelegated`.

Before you start, you need:

* An account that may create app registrations in Microsoft Entra ID, and grant admin consent.
* On premise: access to the server's `conf/config.yml` and permission to restart Valsight.

## Steps

### 1. Register Valsight in Microsoft Entra ID

One app registration can serve several Valsight instances.

1. In the Azure portal, open **Microsoft Entra ID → App registrations → New registration**.
2. Enter a name, for example `Valsight Power BI`, and choose **Accounts in this organizational directory only**.
3. Add a redirect URI of platform **Web** for every Valsight instance:

   ```
   https://<your-valsight-host>/authorized/<registration-id>
   ```

   `<registration-id>` is the name you give the registration in step 4, for example `powerbiDelegated`. Do not use `openIdConnect`, which Valsight reserves for the login. If Valsight runs under a path, include it: `https://<host>/<path>/authorized/powerbiDelegated`. The URI must match exactly, without a trailing slash.
4. Under **Certificates & secrets**, create a client secret and copy its **Value**. It is shown only once. Note the expiry date: Valsight needs the new secret before the old one runs out.
5. On the **Overview** page, note the **Application (client) ID** and the **Directory (tenant) ID**.

### 2. Grant the API permissions

Under **API permissions → Add a permission → Power BI Service → Delegated permissions**, add:

* `Workspace.Read.All`
* `Dataset.Read.All`

Under **Microsoft Graph → Delegated permissions**, add `offline_access`. Keep `User.Read`, which Entra ID adds by default. Then click **Grant admin consent** so that users are not asked to consent one by one.

### 3. Prepare Power BI

In the Fabric admin portal under **Tenant settings**, **Semantic Model Execute Queries REST API** (in **Integration settings**) must be enabled. It is enabled by default.

Valsight only reads **shared workspaces**. A user's personal **My workspace** is never listed and cannot be imported from, so semantic models that Valsight should read must be published to a shared workspace.

Each user who imports needs:

* A Power BI Pro or Premium Per User license, unless the workspace is on Premium or Fabric capacity.
* The **Build** permission on the semantic model. The workspace roles **Contributor**, **Member** and **Admin** include it; **Viewer** does not.

### 4. Configure the client registration in Valsight

Add the registration to `conf/config.yml`, under the same keys as the other [OAuth 2.0 data source registrations](/oauth-2-0-for-url-external-data-source-authentication-configuration/), and restart Valsight. Do not change registrations that already exist.

```yaml
spring:
  security:
    oauth2:
      client:
        registration:
          # any id; it is part of the redirect URI from step 1
          powerbiDelegated:
            client-id: <application-client-id>
            client-secret: <client-secret-value>
            authorization-grant-type: authorization_code
            scope: https://analysis.windows.net/powerbi/api/Workspace.Read.All, https://analysis.windows.net/powerbi/api/Dataset.Read.All, offline_access
        provider:
          powerbiDelegated:
            issuer-uri: https://login.microsoftonline.com/<tenant-id>/v2.0
```

The registration must use `authorization_code`. Valsight recognises a Power BI registration by its `https://analysis.windows.net/powerbi/api/` scope, so it is never offered to CSV URL Download data sources, and other registrations are never offered for Power BI.

## Verify

1. In a project, open **Data Sources** and create a new data source. **Power BI** is listed under **Data Source Type**.
2. Select it. **Power BI Access** shows **Your own Power BI account**.
3. Click **Connect to Power BI**. You are sent to the Microsoft sign-in and back to the form, which shows **Connected as** with your account and lists your workspaces. A Microsoft error about the redirect URI means the URI from step 1 does not match the instance address exactly.