Skip to main content
Version: current [26.x]

Power BI SSO Microsoft Entra ID Fails with Error AADSTS650052

Problem​

This problem applies to Dremio Software v20 or later, because Single Sign On (SSO) authentication is already working for UI logins.

After configuring SSO with Microsoft Entra ID, add the tenant info in the Dremio UI, you complete the following steps to connect to Power BI:

  1. Select the Dremio Software connector and enter the Dremio Server name and click OK.
  2. Select Microsoft Account and click Sign in.
  3. On the pop-up message, specify your Microsoft Entra ID user and password credentials, and click Sign In.
  4. (Optional) If there is another pop-up message stating Microsoft has enabled Security Defaults to keep your account secure, click Skip for now....

Then in the Power BI login, you are receiving the following error:

access_denied: AADSTS650052: The app needs access to a service ('https://connectors.dremio.app/powerbi') that your <organization ID> has not subscribed to or enabled. Contact your IT Admin to review the configuration of your service subscriptions. <Trace ID> <Correlation ID>

Solution​

First, you need to confirm the correct tenant ID is being used in the Dremio UI. You can find your Microsoft Entra ID Tenant ID by signing into the Azure portal and navigating to Dremio > Overview > Basic information.

After you have found your tenant ID, paste the following into a browser:

URL to paste into browser 
https://login.microsoftonline.com/<tenant_ID>/v2.0/adminconsent?client_id=429333a8-1521-4502-9101-6d4f2c1de644&&scope=User.Read&redirect_uri=http://localhost/myapp/permissions

You will need to change the tenant ID to the one you obtained before hitting Enter in the browser. The value entered in the Dremio UI should also match this value.

Next, sign in with your Dremio account. You will then be directed to a screen that asks an admin to sign in. It will look similar to this message:

You will see an error at the end about not finding a redirect page, but this is okay. The command above it does not have this set to a valid value.

Then, try connecting with Power BI again. You might be asked once more to grant permissions. An error in the message causes it to state that permissions are required for Microsoft Power Query for Excel. Instead, it is Dremio that the permissions are required for.

The next step depends on whether you are a Microsoft Entra ID admin and the setting under User consent for applications selected in Microsoft Entra ID:

  • If you are a Microsoft Entra ID administrator:
    • If Do not allow user consent is selected in Microsoft Entra ID, clicking Accept accepts for all of your Power BI users who subsequently connect to Dremio. Those users will not receive a message asking them to grant Dremio required permissions.
    • If Allow user consent for apps is selected in Microsoft Entra ID, clicking Accept accepts only for yourself. All of your Power BI users who connect to Dremio will also be asked to grant Dremio permissions.
  • If you are not a Microsoft Entra ID administrator:
    • If Do not allow user consent is selected in Microsoft Entra ID, you are not able to accept. Instead, you must contact your Power BI administrator.
    • If Allow user consent for apps is selected in Microsoft Entra ID, clicking Accept accepts only for yourself.