/
Supportvalsight.ai
Open in ClaudeOpen in ChatGPT

Power BI Data Source Authentication Configuration

Goal

Projects on your Valsight installation can create Power BI data sources. The Power BI data source type appears once a Power BI client registration is configured.

Valsight reads Power BI as the user who starts an import, shown to users as Your own Power BI account. Each user signs in with their Microsoft account and sees what they can see in Power BI, row-level security included. No Power BI admin setting beyond the defaults is needed. Imports are always started by a user; Valsight does not schedule them.

Valsight cloud customers: carry out steps 1 to 3 in your own Microsoft tenant, then send Valsight the Directory (tenant) ID, the Application (client) ID and the client secret value over a secure channel, with the secret’s expiry date. Valsight configures your instance (step 4). For the redirect URI in step 1, use your instance address, for example https://<instance>.valsight.cloud/authorized/powerbiDelegated.

Before you start, you need:

  • An account that may create app registrations in Microsoft Entra ID, and grant admin consent.
  • On premise: access to the server’s conf/config.yml and permission to restart Valsight.

Steps

  1. 1. Register Valsight in Microsoft Entra ID

    One app registration can serve several Valsight instances.

    1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration.

    2. Enter a name, for example Valsight Power BI, and choose Accounts in this organizational directory only.

    3. Add a redirect URI of platform Web for every Valsight instance:

      https://<your-valsight-host>/authorized/<registration-id>

      <registration-id> is the name you give the registration in step 4, for example powerbiDelegated. Do not use openIdConnect, which Valsight reserves for the login. If Valsight runs under a path, include it: https://<host>/<path>/authorized/powerbiDelegated. The URI must match exactly, without a trailing slash.

    4. Under Certificates & secrets, create a client secret and copy its Value. It is shown only once. Note the expiry date: Valsight needs the new secret before the old one runs out.

    5. On the Overview page, note the Application (client) ID and the Directory (tenant) ID.

  2. 2. Grant the API permissions

    Under API permissions → Add a permission → Power BI Service → Delegated permissions, add:

    • Workspace.Read.All
    • Dataset.Read.All

    Under Microsoft Graph → Delegated permissions, add offline_access. Keep User.Read, which Entra ID adds by default. Then click Grant admin consent so that users are not asked to consent one by one.

  3. 3. Prepare Power BI

    In the Fabric admin portal under Tenant settings, Semantic Model Execute Queries REST API (in Integration settings) must be enabled. It is enabled by default.

    Valsight only reads shared workspaces. A user’s personal My workspace is never listed and cannot be imported from, so semantic models that Valsight should read must be published to a shared workspace.

    Each user who imports needs:

    • A Power BI Pro or Premium Per User license, unless the workspace is on Premium or Fabric capacity.
    • The Build permission on the semantic model. The workspace roles Contributor, Member and Admin include it; Viewer does not.

  4. 4. Configure the client registration in Valsight

    Add the registration to conf/config.yml, under the same keys as the other OAuth 2.0 data source registrations, and restart Valsight. Do not change registrations that already exist.

    spring:
  security:
    oauth2:
      client:
        registration:
          # any id; it is part of the redirect URI from step 1
          powerbiDelegated:
            client-id: <application-client-id>
            client-secret: <client-secret-value>
            authorization-grant-type: authorization_code
            scope: https://analysis.windows.net/powerbi/api/Workspace.Read.All, https://analysis.windows.net/powerbi/api/Dataset.Read.All, offline_access
        provider:
          powerbiDelegated:
            issuer-uri: https://login.microsoftonline.com/<tenant-id>/v2.0

    The registration must use authorization_code. Valsight recognises a Power BI registration by its https://analysis.windows.net/powerbi/api/ scope, so it is never offered to CSV URL Download data sources, and other registrations are never offered for Power BI.

Verify

  1. In a project, open Data Sources and create a new data source. Power BI is listed under Data Source Type.
  2. Select it. Power BI Access shows Your own Power BI account.
  3. Click Connect to Power BI. You are sent to the Microsoft sign-in and back to the form, which shows Connected as with your account and lists your workspaces. A Microsoft error about the redirect URI means the URI from step 1 does not match the instance address exactly.
Was this page helpful?