Why SSO Fails with Azure Analysis Services in Power BI
You have a Power BI dataset that connects to an Azure SQL Database. You need to use single sign-on (SSO) so that users' identities are passed to the database. What authentication method should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth2 with Microsoft Entra ID
OAuth2 with Microsoft Entra ID (option C) is correct because Power BI's SSO to Azure SQL Database relies on Microsoft Entra ID token-based authentication, where the user's Entra ID identity is passed through to the database via OAuth2, enabling row-level security and auditing per user. Azure SQL Database natively supports Entra ID authentication, and Power BI can forward the user's token when the data source is configured with DirectQuery and SSO enabled. Windows authentication (A) is not applicable since Azure SQL Database does not accept on-premises Windows/Kerberos credentials directly without a gateway and Entra ID setup. Key authentication (B) uses a shared key rather than a user identity, so it cannot provide SSO. Basic authentication with a service account (D) uses a single shared credential, not the individual user's identity, so it also fails to meet the SSO requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows authentication
Why it's wrong here
Windows authentication is designed for on-premises environments where the user's identity can be validated against Active Directory via the gateway, using protocols like Kerberos or NTLM. However, Azure SQL Database is a cloud service and is not domain-joined, so Windows integrated security cannot be used directly. Even when routed through a gateway, it only grants the gateway's identity, not the end user's, and fails to provide SSO.
- ✗
Key authentication
Why it's wrong here
Key authentication relies on a static API key or access key, which is common for service-to-service communication or REST APIs, but Azure SQL Database does not accept keys for user-level database authentication. SQL Database instead recognizes SQL logins or Microsoft Entra ID tokens; a key cannot carry the signed-in Power BI user's context, making it inherently unsuitable for SSO. Keys also lack expiry and per-user identity, creating security and compliance issues.
- ✓
OAuth2 with Microsoft Entra ID
Why this is correct
OAuth2 with Microsoft Entra ID is the correct choice because Power BI can obtain an OAuth2 access token from Microsoft Entra ID on behalf of the signed-in user and pass that token to Azure SQL Database. This enables true single sign-on (SSO) because the database sees the individual user's identity rather than a shared service account. Consequently, row-level security (RLS) and audit logs reflect the actual user, and conditional access policies in Entra ID are enforced.
- ✗
Basic authentication with a service account
Why it's wrong here
Basic authentication with a service account uses a single SQL login and password shared across all report viewers, which completely defeats SSO. Because every user's query runs as the service account, you lose the ability to apply per-user row-level security, and audit trails cannot distinguish who accessed what. The static nature of the credential also introduces a security risk and additional administrative overhead when it expires or needs rotation.
Go deeper
Related to this question
About these practice questions
One of 524 original PL-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.