Forum Discussion

AGherardi's avatar
AGherardi
Copper Contributor
Feb 23, 2025

Unable to process AAS model connecting to Azure SQL with Service Account

Hello

I have built a demo SSAS model that I am hosting on an Azure Analysis Services Server. The model connects to an Azure SQL database in my tenant (the Database is the default AdventureWorks provided by Azure when creating your first DB). 

To connect to the Azure SQL, I have created an App (service principal) and granted it reader access to my Azure SQL DB. If I login to the Azure SQL DB from SSMS with this account, using Microsoft Entra Service Principal Authentication providing ClientId@TenantID for the Username and SecretValue as the password, I am able to login and SELECT from the tables.

However, when I try to process the SSAS model, I get an error. For reference, below I have put the TMSL script that sets the DataSource part of the SSAS after deployment via YAML pipelines (variables are replaced when running). I think the issue lies in the "AuthenticationKind" value I have provided in the credential, but I can't figure out what to use. When I create the datasource like this and process, I get error: Failed to save modifications to the server. Error returned: '<ccon>Windows authentication has been disabled in the current context.</ccon>.

I don't understand why since I am not using Windows authentication kind. Every other keyword I used ib the "AuthenticationKind" part returns error AuthenticationKind not supported. Any help on how to change this script would be useful.

 

{
  "createOrReplace": {
    "object": {
      "database": "$(AAS_DATABASE)",
      "dataSource": "$(AZSQLDataSourceName)"
    },
    "dataSource": {
      "type": "structured",
      "name": "$(AZSQLDataSourceName)",
      "connectionDetails": {
        "protocol": "tds",
        "address": {
          "server": "$(AZSQLServer)"
        },
        "initialCatalog": "$(AZSQLDatabase)"
      },
      "credential": {
        "AuthenticationKind": "ServiceAccount",
        "username": "$(AZSQL_CLIENT_ID)@$(AZSQL_TENANT_ID)",
        "password": "$(AZSQL_CLIENT_SECRET)"
      }
    }
  }
}

analytics
azure
Data + Storage
devops
  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Feb 26, 2025

    How about this:

     

    {
  "createOrReplace": {
    "object": {
      "database": "$(AAS_DATABASE)",
      "dataSource": "$(AZSQLDataSourceName)"
    },
    "dataSource": {
      "type": "structured",
      "name": "$(AZSQLDataSourceName)",
      "connectionDetails": {
        "protocol": "tds",
        "address": {
          "server": "$(AZSQLServer)"
        },
        "initialCatalog": "$(AZSQLDatabase)"
      },
      "credential": {
        "AuthenticationKind": "ServicePrincipal",
        "username": "$(AZSQL_CLIENT_ID)",
        "password": "$(AZSQL_CLIENT_SECRET)",
        "tenantId": "$(AZSQL_TENANT_ID)"
      }
    }
  }
}

     

Resources