Using Power BI Service with Windows Authentication

You can publish and share reports in Power BI Service, so that other users can also run them. This can be achieved by configuring AtScale to authenticate with an external directory that supports Windows Authentication.

Note

If you manage users with Microsoft Entra ID, you can use token-based authentication. For more information, see Using Power BI Service with token-based authentication.

Before you begin

Configure authentication with external directory

AtScale must be configured to use either Kerberos or NTLM. You can set this up via the Identity Broker. For more information, see Connecting to an LDAP Server, Configuring Kerberos, and Connecting to Active Directory via NTLM Pass-Through (Netlogon).

Additionally, you must enable the auth.ntlm.enabled engine setting.

Required Azure and Power BI Services

The following services must be enabled for your account:

You must have an Azure Active Directory Domain Services managed domain. For details see the Microsoft Azure Active Directory Domain Services Tutorial.
Configure Power BI Gateway to work with Azure AD. For details see the Power BI Gateway Manage Gateway Data Sources Documentation for Analysis Services and the corresponding video tutorial.
Create domain accounts and Power BI Service accounts for each report users as well as the "service account" that will be used to communicate with AtScale.

Configuring Power BI Gateway

Install Power BI Gateway on a Windows machine that is in the same domain as your Directory server.
This server should be reachable from Power BI Service via a secure connection (for example, IP Sec Tunnel), and should be able to access your AtScale server. For more information see the Power BI Gateway documentation.
Login to Power BI Service as a pbi service admin and go to Settings > Manage Gateways. Follow the Microsoft documentation instructions to connect to your Gateway.
Click Add Datasource on the Manage Gateways screen.
Give your AtScale datasource a name and select Analysis Services as the data source type.
Enter the necessary connection information to connect to the AtScale server.
1. You must use exactly the same string for the hostname that will be used in your reports authored with Power BI Desktop.
  Power BI Service and Power BI Desktop use exact string matching to find host configurations, and will not perform hostname or IP address resolution when looking up dataset connections.
2. The user name must include your Windows domain. For example, either bob.smith@mydomain.com or mydomain.com\\bob.smith will work.
3. For the Database field you must enter the AtScale catalog Name (not the model name).
  Note
  You must set the same query string parameter to the Server field of all desired Datasource configurations.
Click Add. A connection confirmation indicates that Power BI Service successfully authenticated the service user against atscale and your directory service.

Publishing and Sharing Reports

As the user in the Impersonation role, create a report using PBI Desktop connected to the AtScale model.
Once ready, publish the report to the PBI Service by clicking the Publish button in Power BI Desktop (must be logged in to Power BI Service).
Using the same account that you used to author the report, log on to the PBI Service.
Find the new report in the workspace you selected when publishing. Click the Share icon.
Type in the user names of the other users that you want to run the report and click the Share button.

Other Power BI Service users will now be able to run the report. Additionally, their identity will be used to enforce runtime model security and will be displayed on the AtScale Query Screen.

What to do next

Learn how to connect Power BI Desktop to AtScale.
Build your report in Power BI. For details see Create reports and dashboards in Power BI.
Review the list of AtScale's Power BI Known Issues and Limitations.