Using the Microsoft ODBC Data Source Administrator

You can use the Microsoft ODBC Data Source Administrator to edit the DSN configuration. Note that the DSN is created during the installation process.

Complete the following steps to edit the DSN configuration:

1. Select Start > Search, and enter ODBC Data Sources in the Search box.
2. Choose the version of the ODBC Administrator that corresponds to the bitness of your application (32-bit or 64-bit).
3. Click the System DSN tab.
4. Select the system data source and click Configure.
5. Edit the information on the Connection tab and click OK.

Note: For .NET Framework 4.0, the driver distributes Microsoft Visual C++ 2015-2022 Redistributable. For .NET Framework 3.5, the driver distributes Microsoft Visual C++ 2008 Redistributable.

Ensuring Registry Access

The driver stores connection information in the Windows registry. To ensure that the driver can write to the registry, perform either of the following actions:

1. Run the calling application as an administrator.
2. Connect via a User DSN instead of a System DSN.

Connecting to Microsoft Power BI XMLA

Establishing a connection to Microsoft Power BI XMLA involves three main steps:

1. Select the appropriate authentication method based on your environment.
2. Configure the required connection properties (such as tokens, secrets, or certificates).
3. Set the target Power BI workspace.

Important: Only workspaces that are hosted in a Power BI Premium capacity are supported. If the workspace does not have Premium capacity, the connection will fail. To verify this in Power BI, open the workspace in your browser and look for a diamond icon next to the workspace name. This is a built-in indicator in the Power BI user interface that identifies workspaces backed by Premium capacity. If the icon is missing, the workspace is not compatible for XMLA connectivity. For more details, see Which Power BI license do I have?

Step 1: Selecting an Authentication Method

Set the AuthScheme property to select the authentication flow that matches your deployment scenario. Supported values include:

• AzureAD – For interactive, user-based login flows.
  • Best suited for desktop applications, development environments, or scenarios where users authenticate through a browser.
  • Supports an embedded OAuth application for simplified setup. However, use a custom app instead if your organization requires advanced security policies or if you're deploying a web-based solution, which requires a registered redirect URI.
  • To register a custom OAuth application for this authentication method, see Creating an Entra ID (Azure AD) Application.
• AzureServicePrincipal – For headless, service-to-service authentication using a client ID and secret.
  • Ideal for CI/CD pipelines, background services, and automated workflows.
  • Requires a custom OAuth application and securely stored client credentials.
  • Important: A Power BI administrator must enable Service Principal authentication in the Power BI Admin portal under Tenant Settings > Developer Settings.
    • This can be enabled for the entire organization or restricted to a specific security group (recommended for granular control).
    • No additional API permissions or OAuth scopes are required in the Entra app registration. Access is controlled through Power BI Admin settings and workspace role assignments.
  • To register a custom OAuth application and configure client credentials for this method, see Creating a Service Principal App in Entra ID.
• AzureServicePrincipalCert – For certificate-based authentication in secure or regulated environments.
  • Best for long-running jobs in security-sensitive environments with strict compliance requirements.
  • Requires a custom OAuth application and a valid client certificate.
  • Important: A Power BI administrator must enable Service Principal authentication in the Power BI Admin portal under Tenant Settings > Developer Settings.
    • This can be enabled for the entire organization or restricted to a specific security group (recommended for granular control).
    • No additional API permissions or OAuth scopes are required in the Entra app registration. Access is controlled through Power BI Admin settings and workspace role assignments.
  • To register a custom OAuth application and upload a client certificate, see Creating a Service Principal App in Entra ID.

Note: The Power BI workspace and the registered service principal must belong to the same Microsoft Entra tenant. XMLA connections do not support cross-tenant access.

Step 2: Configure Required Connection Properties

After setting AuthScheme, set the connection properties required for your selected authentication method. These properties allow the driver to authenticate securely and request access tokens from Microsoft Entra ID (formerly Azure Active Directory). The exact set of properties vary depending on whether you are using an embedded or custom OAuth application, and whether you're authenticating with user credentials, a client secret, or a certificate.

Note: For AzureAD authentication, the embedded OAuth application automatically requests the required Delegated permissions. If you register a custom OAuth application, add the Delegated permissions Dataset.Read.All and Workspace.Read.All in Microsoft Entra ID. For Service Principal authentication, you do not need to add API permissions. Access is controlled entirely through Power BI Admin settings and workspace role assignments.

Step 3: Set the Target Workspace

After authentication is configured, set the Workspace property to specify the Microsoft Power BI workspace you want to connect to. Only workspaces that are hosted in a Power BI Premium capacity are supported. If the workspace does not have Premium capacity, the connection will fail.

You can verify workspace capacity by opening the workspace in Power BI. Look for a diamond icon next to the workspace name. This indicates that the workspace is backed by Premium capacity.

For more details, see Which Power BI license do I have?

Important: A Service Principal must have at least the Member role in the target workspace to access XMLA endpoints. Admin access is optional and not required.

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Microsoft Power BI XMLA endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

You can authenticate from a desktop application using either the driver's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered application, included with the driver. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

• AuthScheme: AzureAD
• InitiateOAuth:
  • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
  • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the driver opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the driver retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

During registration, record the following values:

• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

For full instructions on how to register a custom OAuth application and configure redirect URIs, see Creating an Entra ID (Azure AD) Application.

Set the following connection properties:

• AuthScheme: AzureAD
• InitiateOAuth:
  • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
  • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

Setup options:

• Obtain and exchange a verifier code
  • Use another device to sign in and retrieve a verifier code, which the headless system uses to request tokens.
• Transfer an OAuth settings file
  • Authenticate on another device, then copy the stored token file to the headless environment.

Using a Verifier Code

1. On a device with a browser:
   • If using a custom OAuth app, set the following properties:
     • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
     • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • Call the GetOAuthAuthorizationUrl stored procedure to generate a sign-in URL.
   • Open the returned URL in a browser. Sign in and grant grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
   • After signing in, save the value of the code parameter from the redirect URL. You will use this later to set the OAuthVerifier connection property.
2. On the headless machine:
   • Set the following properties:
     • AuthScheme: AzureAD
     • OAuthVerifier: The verifier code you saved.
     • OAuthSettingsLocation: The path of the file that holds the OAuth token values.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • After tokens are saved, reuse them by setting:
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

Transferring OAuth Settings

1. On a device with a browser:
   • Connect using the instructions in the Desktop Applications section.
   • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

   Encrypted values are stored in the system registry.

2. On the headless machine:
   • Copy the OAuth settings file to the machine.
   • Set the following properties:
     • AuthScheme: AzureAD
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • For custom applications:
       • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
       • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

After setup, the driver uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Service principals are security objects within a Microsoft Entra ID (Azure AD) application that define what that application can do within a specific tenant. Service principals are created in the Entra admin center, also accessible through the Azure portal. As part of the creation process we also specify whether the service principal will access Entra resources via a client secret or a certificate.

Depending on the service you are connecting to, a tenant administrator may need to enable Service Principal authentication or assign the Service Principal to the appropriate roles or security groups.

Instead of being tied to a particular user, service principal permissions are based on the roles assigned to them. These roles determine which resources the application can access and which operations it can perform.

When authenticating using a service principal, you must register an application with an Entra tenant, as described in Creating a Service Principal App in Entra ID.

This subsection describes properties you must set before you can connect. These vary, depending on whether you will authenticate via a client secret or a certificate.

Authentication with Client Secret

• AuthScheme: AzureServicePrincipal.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client ID in your application settings.
• OAuthClientSecret: The client secret in your application settings.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Authentication with Certificate

• AuthScheme: AzureServicePrincipalCert.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client Id in your application settings.
• OAuthJWTCert: The JWT Certificate store.
• OAuthJWTCertType: The JWT Certificate store type.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Troubleshooting Connection Issues

For help with common errors and setup problems, see Connection Troubleshooting.