Share via

Power BI Dataflow Fails to Connect to AAS Due to Firewall Restrictions

somyasri 0 Reputation points
2025-07-21T13:30:00.07+00:00

We faced an issue where Power BI Dataflows were unable to connect to Azure Analysis Services when the firewall was enabled, showing a “credential is invalid” error. Please find the error below:

User's image

However, the same credentials work correctly when the firewall is disabled, and Power BI reports/Semantic Model connect successfully even with the firewall turned on. User's image

As per the above image PowerBi services shall be accessed when Firewall is enables but the DataFlow give error whereas the semantic models work fine.

Can someone suggest any resolution for the same

Azure Analysis Services

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nandan Hegde 36,396 Reputation points MVP Volunteer Moderator
    2025-07-22T13:35:23.5+00:00

    You can whitelist the IP of Power Query Online that MSFT provides for the region in which the Dataflow is created in.

    https://www.microsoft.com/en-us/download/details.aspx?id=56519

    0 comments
  2. Pratyush Vashistha 975 Reputation points Microsoft External Staff Moderator
    2025-07-22T15:59:48.7366667+00:00

    Hello somyasri!

    Thanks for the update. That’s good that whitelisting PowerQueryOnline.WestUS IPs resolved the issue. It makes perfect sense why you'd have these questions.

    To answer your following questions,

    1. Why did whitelisting West US IPs solve it, when your tenant is in "United States" and AAS is in North Europe?

    Think of it like this: Even though your Power BI is generally in the "United States" region, the specific engine that runs your Dataflow refreshes (Power Query Online) is a massive, distributed service. For connections heading outside the US, or simply due to how their internal network routes traffic for efficiency, your dataflow's outbound connection ended up physically exiting Microsoft's network through a datacentre in West US. It acts as a dedicated "exit point" for those types of connections.

    2. How to ensure you're consistently whitelisting the correct IP ranges for reliable Dataflow connectivity?

    The best way is to use Azure Service Tags. Microsoft manages these tags, so when their internal IPs change or new exit points appear, the tag updates automatically, and your firewall rules stay correct.

    • If your Azure Analysis Services is in a Virtual Network (VNet): This is ideal. Go to the Network Security Group (NSG) on the VNet subnet where AAS lives. Add an inbound rule that allows traffic from the PowerQueryOnline Service Tag on port 2382. This covers all the necessary IPs without you having to manually update them.
    • If your Azure Analysis Services is a Public Endpoint (not in a VNet): The AAS firewall itself doesn't directly use service tags for IP rules. In this case, you'll need to automate pulling the IP ranges associated with the PowerQueryOnline service tag (from Microsoft's public IP list) and use a script (like PowerShell or Azure CLI) to update your AAS firewall rules regularly. This ensures you always have the most current IPs without manual effort.

    For more information, please refer the following links

    Service Tags:

    https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

    AAS FAQs:

    https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-network-faq?view=sql-analysis-services-2025

     

    I hope this helps. Let me know if you have any further questions or need additional assistance.

     Also, if these answers your query, do click the "Accept the answer" which might be beneficial to other community members reading this thread.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.