Be careful with Azure Stream Analytics, PowerBi and Azure AD MFA


Ran into an interesting situation today.  I have some real time Azure Stream Analytics (ASA) streams that feed a couple Power BI dashboards.  I also took the plunge with getting enabled with Azure Multi Factor Authentication (MFA).  The MFA setup was fine but I logged back into the Azure Portal later to notice that my ASA job had stopped.  When I looked in the ASA Monitoring Logs I found the following Send Error:

image

Followed by a User authentication error:

image

I was able to put 2 and 2 together and the timelines aligned to when my MFA was turned on but I was still perplexed.  I mean this wasn’t a Windows service that had an out of date password. My credentials were never associated to the ASA job. I did use MFA when logging into the portal so that wasn’t it.  I tried to restard the ASA job multiplie times as the portal was giving me a “this is a transient error message”….it wasn’t.

It wasn’t until it clued in on me that when you set Power Bi Outputs for Stream Analytics that you need to also authenticate using your credentials.  As soon as MFA was enabled, my credentials had expired and I needed to log back in which did result in an MFA challenge.  I got through that and could start my job and outstanding events streamed through.

Conclusion

This isn’t a production workload so the damage was minimal.  It does beg the question thought that if you are publishing events from ASA to PowerBI, what is the right way to authenticate with Power BI?  Should you be creating a “system” account with no MFA and no password being reset?  I am open to recommendations if you have them. 

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s