Community Spring Cleaning week is here! Join your fellow Maveryx in digging through your old posts and marking comments on them as solved. Learn more here!

Alteryx Designer Desktop Discussions

Find answers, ask questions, and share expertise about Alteryx Designer Desktop and Intelligence Suite.

Power BI Output Tool - Azure App Registration API Permission / Consent issue and FIX

Ben_Moore
6 - Meteoroid

Power BI Output Tool 3.1.0

Designer 2021.3.3 +

 

When following the API Application Setup section for the Microsoft Power BI Output Tool located at "https://help.alteryx.com/20214/designer/microsoft-power-bi-output-tool", I encountered an issue with API permissions and consent and have found a fix that will be helpful to others and could maybe be considered for inclusion in a future release?

 

Background:

 

When you set up a Power BI Output component in Alteryx Designer, it needs to set up an app registration in Azure to handle the permissions.  If you use the "Sign in via Internet Browser" authentication method, it creates one of these app registrations for you with built-in settings, as long as you are running Alteryx as a user that has enough permissions to Azure to be able to consent to creating the app and giving it the API permissions it needs.

 

In an organization with a decent Azure footprint, that workflow will likely be discouraged, as your Azure admins are likely not the users running Alteryx designer themselves and having them shadow you on your PC and input their credentials at an admin consent prompt is likely not best practice.  So on the above mention Alteryx Power BI Output Tool page instructions are provided on how to do your own app registration in Azure and what permissions need to be granted.  An Azure admin can then take these instructions, create the Azure App Registration with the appropriate API Permissions, CONSENT on behalf of the organization that these API permissions are appropriate, and then all Alteryx users should be able to use the output tool through the app.

 

The issue I ran into is that even if consent was already granted to the Azure app registration, when trying to connect and authenticate the Power BI output tool an admin consent prompt would still be presented.  I tracked this down to an additional "Group.Read.All" permission that the tool was requesting.  Because it requested an additional permission, it was requiring additional consent for that new permission to be added.  "Group.Read.All" is a legacy permission of the Power BI API that no longer exists.  It cannot be "granted" ahead of time when creating an app registration in the Azure Portal.  Obviously an issue.

 

So I dug into the Power BI Output Tool code to see what was going on.  There were a couple of issues I found. 

 

The first is in the "app.0583c26040a9777c5c0f.chunk.js" file.  This can be found in the "PowerBI_v3.1.0" folder of the installer, or if you are testing out a fix on a system with the tool already installed it can be found either in the global Alteryx install location "C:\ProgramData\Alteryx\Tools\PowerBI_v3.1.0" or if you only installed for your own user it could be in the same subfolders off of the root Alteryx directory at "C:\Users\[Your User ID]\AppData\Roaming\Alteryx".

 

The last line in the file "app.0583c26040a9777c5c0f.chunk.js" (it's a very long line)  contains several references to the deprecated API permission.  You can search for and delete any references to "https://analysis.windows.net/powerbi/api/Group.Read.All \n"  or to "https://analysis.windows.net/powerbi/api/Group.Read.All".  Save the file after these changes (make a backup of the original first of course just in case), restart Alteryx designer, try to connect to your Azure Power BI App, and VOILA, it is now connecting successfully!

 

You can prepare your workflow now, but if you try to run it, it will generate an error.  This is because there is one additional python component in the Power BI Output tool that also needs to be modified.

 

If you are looking to update the installer look for the file "power_bi-0.0.1+build.922079-py3-none-any.whl" within the ""PowerBI_v3.1.0\Wheels" folder.  Within this whl archive look for the "constants.py" file in the "power_bi\power_bi_output\constants" folder.  If you are looking to test this fix on an already installed system, the wheels directory where the whl archive is located can be found at "C:\ProgramData\Alteryx\Tools\PowerBI_v3.1.0\wheels".  But if you change the constants.py file in there it won't change anything because the whl file has already been installed to your tool's virtual python environment.  So for a quick edit test, you could alter the "constants.py" file at it's installed location similar to  "C:\ProgramData\Alteryx\Tools\PowerBI_v3.1.0_venv\Lib\site-packages\power_bi\power_bi_output\constants".

 

This "constants.py" file has a single "https://analysis.windows.net/powerbi/api/Group.Read.All" entry that should be searched for and deleted.

 

Once these changes have been applied to both the "app.0583c26040a9777c5c0f.chunk.js" and the "constants.py" files of removing the deprecated "Group.Read.All" scope API permissions, the Power BI Output tool will be able to both authenticate with and run successfully in a workflow with the original Azure app registration consents you followed in the howto document.

 

Hopefully this helps out some of you out there with a similar issue, and hopefully Alteryx will review this and consider implementing the fixes in a future release of the Power BI Output Tool.

8 REPLIES 8
Ben_Moore
6 - Meteoroid

Power BI Output Tool 3.2.0

Designer 2021.4.2 +

 

FYI, this issue still persists with Power BI Output Tool 3.2.0.  The fix outlined in this post is the same so follow the instructions, only with output tool 3.2.0 the first javascript file you will need to edit is now named "app.aaa1011065604ed36868.chunk.js".

 

Also, in my environment 3.2.0 introduced a new issue where I was getting an error on auth in the first prompt of the web browser that I was not set up as multi-tenant and it would stop me there.  3.1.0 did the same thing basically and you can see in the Azure logs if you care to look, the way auth is working for this plugin is it tries multi-tenant and if multi-tenant fails it will re-prompt you for auth and this time it tries single-tenant, that's why you get double-prompted for auth.  I found the culprit for this issue with 3.2.0 stopping on the first prompt to be the Redirect URIs.  With 3.2.0 you need to remove the "spa" app redirects you set up previously and create a single new "web" redirect that points to "http://localhost/".  After that, you'll get the double-prompt like you did before and at the end the auth will connect successfully.

AndrewSu
Alteryx
Alteryx

@Ben_Moore , this is great stuff.  I've escalated internally to our team to find out when we can get this resolved.  Thank you for being a valued member of the community!  

 

I'll be sure to keep this thread posted on the developments. 

bertal34
8 - Asteroid

@Ben_Moore @AndrewSu 

Has this been corrected in the latest version of the tool, 3.3.0 ?  Or are the code edits still necessary?

AndrewSu
Alteryx
Alteryx

@bertal34 ,  I believe the newest version should address the issue!

 

Please download the latest tool, test and let us know your findings. 

 

Please mark response as the solution if it does work so that others in the community can benefit from our collaboration. 

 

Thanks. 

AndrewSu
Alteryx
Alteryx

@Ben_Moore , @bertal34 , I've received confirmation that the latest release of the tool addresses the issues. 

 

@Ben_Moore , please mark this post as the solution to your issue so that others in the community can benefit from our collaboration. 

 

Thanks. 

Ben_Moore
6 - Meteoroid

Thanks @AndrewSu for following up.

 

I'm testing out the Power BI Output Tool 3.3.1 against Alteryx 2022.3.1 now.

 

Doing the initial auth to the Power BI service in the left hand panel is working now without tweaks, so that's a good sign!

 

But unfortunately, I haven't got a successful run with this version with initial testing.

 

I tested installing the tool in user only mode, and would get these types of errors on the tool in the canvas right when the object was added or when attempting to run:

Error: Power BI Output (8): Internal error: Failed to read port assignment

Error: Power BI Output (8): Internal Error - Deadlock detected (@1)

 

I tested installing the tool as an admin for all users, and got different behavior.  When clicking on and off of the object in the canvas I get hangups and then error messages like this appear:

Error: Power BI Output (7): Failed to write plugin initialization data.

Error: Power BI Output (7): You have found a bug.  Replicate, then let us know.  We shall fix it soon.

Error: Designer x64: Initialization Timed Out:  Workflow must be run for field meta info to be accurate.

 

If attempting to run I have seen messages like this:

Error: Power BI Output (7): Failed to send RecordTransferIn

 

So, none of my tests yet with this latest version have produced any output to the Power BI service.  I may have to do a bit more troubleshooting as time permits.

AndrewSu
Alteryx
Alteryx

@Ben_Moore , my apologies for the delayed response.  Are you still encountering this issue?

 

Have you had a chance to submit a ticket to our support team? 

 

 

jimgillespie
5 - Atom

If this thread is still open, can anyone provide some detail about the issues outputting DateTime values with the PowerBI output connector?  I understand Date data can be formatted to string, but this opens up another set of issues when using the data in the Power BI service or Desktop.  Due to limitations with live connections (at least my understanding) you cannot convert the string values back to DateTime values once in the service.  This more or less makes Date filtering/slicing impossible.  Anyone have thoughts on this?  Currently working on getting Dataverse connector set up, so hopefully that will be a little more forgiving!  Thanks for the great posts all. 

Labels