power bi connectivity with snowflake

Question

how a user authentificate to powerbi services and access to aws snowflake with sso

Answer 1

For Power BI service authentication, the user signs in through Microsoft Entra ID. The sign-in flow uses the Microsoft Entra auth code grant flow: the browser is redirected to the Microsoft sign-in page, the user is authenticated, and tokens are then used by the Power BI service.

For Snowflake access with SSO in Power BI service, the flow is:

1. A Fabric administrator enables Snowflake SSO in Power BI Admin portal:
   • Settings > Admin portal
   • Tenant settings > Integration settings
   • Expand Snowflake SSO, set it to Enabled, and select Apply
   • This setting is organization-wide and can take up to an hour to take effect.
2. The semantic model creator configures the published Snowflake semantic model to use Microsoft Entra ID:
   • Open the workspace in Power BI service
   • Open the semantic model Settings
   • Go to Data source credentials and sign in to Snowflake with OAuth2 (Microsoft Entra ID)
   • Enable End users use their own OAuth2 credentials when accessing this data source via DirectQuery
3. Users then access the report in Power BI service. After this is configured, their Microsoft Entra credentials are sent to Snowflake for SSO.

Important behavior:

• Microsoft Entra ID SSO for Snowflake supports DirectQuery only.
• If SSO is not enabled, report access uses the credentials of the user who signed in to the semantic model, not the end user.
• If an on-premises data gateway is configured only for that Snowflake data source in the model, the semantic model gateway setting should be switched to Off for that data model when not using the gateway.
• Snowflake-side Microsoft Entra integration must also be configured.

---

• Connect to Snowflake in the Power BI service
• Power BI security white paper
• Snowflake