Power BI Workspace Identity Authentication
What credentials do you use to refresh your Power BI semantic models from Azure SQL SKUs, such as Azure SQL Database. Probably your credentials or a designated Entra account? Both are not ideal for a variety of reasons, including requiring a password. More advanced users might be using service principals, which are more secure but require secret renewal after a maximum of 24 months, which is a hustle.
Somewhere along the way without me noticing, Microsoft added a better authentication option for refreshing Power BI semantic models: workspace identity. This option lets the Power BI workspace using its own managed identity to authenticate to the data source. And it’s available in all Power BI and Fabric SKUs!
What’s not clear from the documentation is how to grant permissions to the workspace identity to read data from Azure SQL SKUs but it’s no different that granting access to the Azure Data Factory managed identity.
- Create the workspace identity as explained in the documentation. It has to be done for each workspace that has your published model(s).
- In SSMS, connect to your Azure SQL Database using Entra credentials that has permissions to manage security (SQL login won’t work).
- Open a new query connected to your database.
- Execute the following script assuming you want to grant read permissions to the workspace identity:
CREATE USER [<workspace name>] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [<workspace name>];
Then back to Power BI, configure your semantic model for workspace identity authentication:
- Navigate to the semantic model settings and click “Edit credentials”.

- Select “Workspace identity” as the authentication method.

That’s it. Using the workspace identity to read data during model refresh is more secure and easier to manage.









