Enhance Power BI export provider to show the user an actionable message when the module fails due to nobody signing into the Power BI user portal

[tkol2022]

Prerequisites

• This issue has an informative and human-readable title.
• Assignee should meet with issue author before starting work.

💡 Summary

For the Power BI export provider to work with interactive authentication, we found that a user in the tenant must sign into the Power BI user portal (aka the dashboard tool) at least once before the Power BI admin settings REST API can be called successfully. If that does not occur the Power BI REST API fails with a 403 error.

Conditions that cause a 403

There are actually two conditions where a ScubaGear user will receive a 403 when running Power BI and they can both be true at the same time. Therefore the fix message should contain a reference two both of them so that the user won't get into a scenario where they add the role but don't do the second action (sign into the user portal).

1. If the user does not have the Fabric Administrator role
2. If nobody in the tenant has ever signed into the Power BI user portal

Motivation and context

We have already received one report about this problem and we want to avoid future troubleshooting sessions. In particular, Power BI is a new baseline in ScubaGear and we want to make the user experience as smooth as possible when running it for the first time.

Implementation notes

Add code the Power BI export provider that will catch the 403 error and display a message noting the two conditions noted above so that the user can rectify the problem.

Acceptance criteria

• User has implemented the fix actions above and conducted proper unit testing.

[tkol2022]

Scope update

@MichaelHicks-MSFT helped confirm that there are a couple of scenarios that impact non-interactive authentication as well, so the problem is not localized to only interactive auth. For non-interactive auth there are two possible error codes (401 and 403). Each is documented in the enhanced version of the Export-PowerBIProvider function.

Here is what the fix message looks like for noninteractive authentication when a security group for the service principal hasn't been configured in the Power BI admin portal under the "Service principals can access read-only admin APIs" setting:

[tkol2022]

Here is what the fix message looks like for interactive authentication if the user does not the Fabric Administrator role or nobody in the tenant has ever logged into the Power BI portal before:

[tkol2022]

Added to sprint for inclusion into 2.0.0 per the discussion at standup. @FollyBeachGurl

[FollyBeachGurl]

Added to sprint for inclusion into 2.0.0 per the discussion at standup. @FollyBeachGurl

that's fine. i know we discussed yesterday but to ensure work isn't done in a silo i am adding this to our agenda tomorrow so the team knows what we are working on (especially since this issue HIGH priority). i also downgraded the priority to HIGH, as URGENT is reserved for break-stop issues/PRs.