Powershell - automated connection to Power BI service without hardcoding password

Question

We have a PowerShell script to pull Power BI activity data (using Get-PowerBIActivityEvent), and I have been trying to automate it so that it can pull this data daily using an unattended account. The problem is the script must necessarily use the Connect-PowerBIServiceAccount cmdlet, which requires a credential. I don't want to have the passwords hard-coded anywhere (obviously) and ideally don't want to be passing it into the script as a plaintext parameter in case of memory leaks.

I've tried using SSIS as a scheduling mechanism since it allows for encrypted parameters in script tasks, but can't call the PS script with a SecureString parameter since the System.Management.Automation namespace isn't in the GAC (a commandline call wouldn't be possible). I don't believe task scheduler would offer the functionality needed.

Does anyone know of any elegant ways to connect to the power BI service using encrypted credentials?

Answer 1

In the docs of Connect-PowerBIServiceAccount there are 2 options for unattended sign-in:

1. Using -Credential , where you pass AAD client ID as username and application secret key as password

2. Using -CertificateThumbprint and -ApplicationId

For both options you need to configure service pricipal and add proper permissions. I'm not going into details how to configure that, but most probably you'd need (at least) the following application permissions:

I'm not really sure what functionalities you need in the script, but in my experience, majority of the cases can be covered by scheduled task, so the explanation below will apply to that solution.

How you can secure the credentials?

There are variuos possible solutions, depending on your preferences. I'd consider certificate-based authentication as more secure (certificate is available only to current user/all users of the machine).

What's important in certificate-based authentication - make sure that the certificate is available for the account running the script (in many cases it's service account, not your user account).

How can I secure more?

If you want, you can store application ID as secure string (I don't have SSIS to test, so I'm not sure if there's any workaround to make it working in there) or use Export-CliXml . They use Windows Data Protection API (DPAPI), so the file can be decrypted only by the account which was used to encrypt.

To add one more level of security (I'm not even mentioning setting correct access rights to the files as it's obvious) you might put the file in the folder encrypted (you might already have a solution for disk encryption, so use it if you wish).

---

There are probably some solutions to secure the keys even better, but these ones should do the job. I'm using other Microsoft 365 modules with similar approach (Outlook, SharePoint PnP) and it works quite well.

NOTE: If you need to use user account, instead of service principal, make sure that you have MultiFactor Authentication disabled on that account for that specific application.

Answer 2

The relevant documentation to this ( https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal ) states that admin APIs (ie those served via Get-PowerBiActivityEvent) do not currently support service principals. This means it's not currently possible to use a registered app to run these cmdlets unattended.

There is a feature request open to provide this at the moment: https://ideas.powerbi.com/forums/265200-power-bi-ideas/suggestions/39641572-need-service-principle-support-for-admin-api