This topic defines making use of Microsoft Power BI to instantiate a Snowflake period and accessibility Snowflake using unmarried sign-on (SSO).

Overview?’A¶

This particular feature removes the need for on-premises Power BI Gateway implementations because the energy BI service makes use of an embedded Snowflake drivers for connecting to Snowflake.

Standard Workflow?’A¶

(Optional) When the identification supplier isn’t Azure offer, then Azure offer verifies the consumer through SAML verification before signing an individual to the electricity BI services.

Whenever the individual connects to Snowflake, the ability BI provider asks Azure advertisement to give it a token for Snowflake.

The ability BI service makes use of the embedded Snowflake motorist to transmit the Azure post token to Snowflake within the link sequence.

Snowflake validates the token, extracts the username through the token, maps they for the Snowflake consumer, and helps to create a Snowflake period for any Power BI service making use of the user’s default part.

Prerequisites?’A¶

In Snowflake, if you should be making use of circle procedures , you can allow the Microsoft Azure IP selection which includes the Azure region in which the Snowflake account is actually managed and any extra Azure parts as required.

To create a network policy definitely certain to energy BI for the Azure area where your Snowflake on Azure profile is located, research the JSON down load from Microsoft for the part.

Assuming the Snowflake on Azure profile is situated in the Canada middle region, lookup the JSON get for PowerBI.CanadaCentral . Find the ip ranges from addressPrefixes checklist. Make use of these internet protocol address range to generate or revise a system coverage in Snowflake.

If you work with numerous Microsoft Azure solutions (example. Energy BI, SCIM), contact your Azure officer to verify the appropriate ip range to be sure the Snowflake network coverage offers the appropriate IP address extends permitting customers to access Snowflake.

Automatically, the levels administrator (i.e users aided by the ACCOUNTADMIN program role) and protection manager (in other words people together with the SECURITYADMIN program part) parts become obstructed by using Microsoft energy BI to instantiate a Snowflake session. If you have a company need to let these parts, and your security employees try at ease with letting they, kindly contact Snowflake service to ask these roles feel allowed for your profile.

Either the login_name , title , and/or email feature your consumer in Snowflake must map towards the Azure advertisement upn feature. In the event the login_name feature is not described, then your process non-payments towards name feature.

Considerations?’A¶

AWS PrivateLink and Azure personal connect are recognized. When it is necessary to need either of these two providers for connecting to Snowflake, use the on-premises portal for connecting.

AWS PrivateLink and Azure Private hyperlink commonly backed. For any energy BI services and electricity BI pc, make a network coverage allowing the Azure dynamic service community IP address range. Keep in mind that circle strategies have actually a 100,000 fictional character restriction when it comes to permitted IP address contact information.

Snowflake tries to confirm Azure dynamic index through URL value from inside the external_oauth_jws_keys_url land (revealed below) or through the allowed internet protocol address details during the network policy, in the event the network coverage prevails. Microsoft upgrades its tokens and tactics every 1 day. For additional info on the Microsoft revisions, see a review of tokens in Azure dynamic Directory B2C.

Acquiring Started?’A¶

This area clarifies how to come up with an electrical BI protection integration in Snowflake and the ways to access Snowflake through energy BI.

Generating an electrical BI Safety Integration?’A¶

This step is not needed if you use the ability BI gateway for Power BI provider for connecting to Snowflake or are utilizing your own Snowflake account for verification.

To use electricity BI to view Snowflake facts through SSO, it is crucial to produce a safety integration for electricity BI using MAKE PROTECTION INTEGRATION as revealed below.

The protection integration must-have the perfect worth for external_oauth_issuer factor. Part of this price maps towards Azure offer occupant. Available this advantages into the About section of your Power BI occupant.

Whether your business keeps an advanced deployment in the Power BI provider, next check with your Azure offer administrator to have the appropriate worth of the Azure advertising tenant to make use of in creating the Issuer URL.

For instance, if your Azure AD occupant ID is actually a828b821-f44f-4698-85b2-3c6749302698 , then construct the AZURE_AD_ISSUER benefits similar to . It is essential to are the onward slash (i.e. / ) after the worth.

After creating the worth for AZURE_AD_ISSUER , carry out the MAKE SECURITY INTEGRATION command. Be sure to put the worthiness for your external_oauth_audience_list protection integration factor precisely according to whether or not their Snowflake membership is situated in the Microsoft Azure national cloud area .

These advice also use the ANY role, makes it possible for for character switching. For more information, discover Using Any variety of character with Power BI SSO to Snowflake .