> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshooting Power BI Access

> Common issues and solutions for Power BI connection problems in both frontend and backend access scenarios.

export const BackendNavPath = ({levelOne, levelTwo, levelThree, tab, section}) => {
  const levels = [levelOne, levelTwo, levelThree].filter(Boolean);
  const lastLevel = levels.length ? levels[levels.length - 1] : '';
  return <span>
      In the <a href="/setup/installation/linux_installation">backend of Curator</a> using the left-hand navigation,
      navigate to the
      {levelOne && <strong>{" " + levelOne}</strong>}
      {levelOne && levelTwo && " > "}
      {levelTwo && <strong>{levelTwo}</strong>}
      {levelTwo && levelThree && " > "}
      {levelThree && <strong>{levelThree}</strong>} page.
      {(tab || section) && <>
          {" "}On the {lastLevel} page
          {tab && <> click the <strong>{tab}</strong> tab</>}
          {tab && section && " and"}
          {section && <> expand the <strong>{section}</strong> section</>}.
        </>}
    </span>;
};

Power BI connections have separate frontend and backend functionality, even though everything is configured from the
backend connection. When troubleshooting issues, it's important to test each area separately since one might work
perfectly while the other fails completely.

***

## Backend User Permissions

After a Power BI connection is saved, the **Power BI** section may not appear in the backend navigation for
some users. This is a permissions issue — the connection is valid, but the backend user has not been granted
access to the Power BI plugin.

Curator automatically grants backend permissions to the user who saves the connection. Other backend users must
be granted access manually:

1. Log in as a super-administrator.
2. Navigate to **Settings** > **Administrators**.
3. Open the affected user's record and click the **Permissions** tab.
4. Under the **PowerBI** section, enable **Power BI administrator**.
5. Save the user record.

***

## User Menu Access Warnings

When viewing the **User Menu Access** tab in the backend, Power BI items may display an amber warning icon
(⚠) next to the menu entry.

This icon means Curator cannot preview a user's access to that item because the **Admin Registered App** is not
configured. Without an Admin connection, Curator has no way to query Power BI's Admin API to determine which
workspaces and reports a user can see.

**How to resolve:**
Complete the [Azure Admin Registered App Setup](/creating_integrations/power_bi_connection/azure_admin_app_setup)
and enter the resulting credentials under
<BackendNavPath levelOne="Settings" levelTwo="Power BI Settings" /> on the **Admin** tab.

Once the Admin connection is saved, the warning icons will disappear and User Menu Access will correctly reflect
each user's Power BI permissions.

***

## Backend Troubleshooting

The backend integration with Power BI is straightforward - there's one reliable way to test it and only a few common
failure points.

### Test if Backend is Working

Follow these steps to verify your backend connection:

1. <BackendNavPath levelOne="Power BI" levelTwo="Reports" />

2. Click the **Clear Cache** button (top right) to ensure fresh data.

3. Click the **New Report** button to navigate to the "Create Report" page.

4. Use the dropdown menus to select a workspace and report

   * **Success:** If you can select both workspace and report, your backend is working! Skip to the
     [Frontend section](#frontend-troubleshooting)
   * **Problem:** If either dropdown is empty when it shouldn't be, continue to the troubleshooting steps below

<img src="https://mintcdn.com/interworks/x0r9dMo3GyjABFAR/assets/images/creating_integrations/power_bi_connection/troubleshooting_power_bi_access_success.png?fit=max&auto=format&n=x0r9dMo3GyjABFAR&q=85&s=f913983afee72a2a025ec879dfadc93b" alt="Power BI Backend Success" width="1114" height="764" data-path="assets/images/creating_integrations/power_bi_connection/troubleshooting_power_bi_access_success.png" />

### Debug Backend Issues

When the backend isn't working, you need to see what Power BI is actually telling Curator.

#### Enable Debug Mode

1. <BackendNavPath levelOne="Settings" levelTwo="Power BI Settings" /> Click on the **Advanced** tab.

2. **Enable debugging**
   Toggle on **Debug Mode for Power BI** and click save

   <Warning>
     Debug mode increases logging and can fill up your server. Set a reasonable **Debug Mode Expiration**
     (default: 24 hours).
   </Warning>

3. **Repeat the steps to recreate the issue**
   Follow the steps in [Test if Backend is Working](#test-if-backend-is-working) again to recreate the issue while
   debug logging is enabled.

4. **Check the logs:**
   1. <BackendNavPath levelOne="Settings" levelTwo="Logs" levelThree="Event Logs" />

   2. **Find Power BI calls**
      Filter for `Power BI API Call` using the search box (top right)

   3. **Review responses**
      Click on entries to see Power BI's detailed responses

For more information about Curator's logging systems, see the [Logging Overview](/site_administration/logging/logging_overview).

#### Common Solutions

**If you see error messages:**
The solution depends on the specific error. Contact Curator support if the fix isn't obvious.

Some errors may be prefixed with `POWER BI ERROR` or `ERROR during powerbi flow`, but others may have different text.

**If responses are blank:**
This means Curator can connect to Power BI, but the admin registered app (or non-admin registered app if not using admin)
lacks workspace access. Try these fixes:

##### 1. Grant workspace access

Follow the [Add Registered App to Power BI Workspace(s)](/creating_integrations/power_bi_connection/power_bi_workspace_access)
instructions

##### 2. Enable Fabric APIs

Follow the [Allow service principals to use Fabric APIs](/creating_integrations/power_bi_connection/power_bi_workspace_access)
instructions
*(Note: This change can take time to take effect in Power BI)*

##### 3. Check security groups

If Fabric APIs are restricted to specific security groups, ensure your registered apps are a member of one of those
groups.

### Expired or Rotated Client Secret

Azure client secrets have a finite lifetime. When you create a client secret in Azure, you choose an expiration
period (commonly 6, 12, or 24 months). Once the secret expires, Power BI will reject Curator's authentication
requests and all Power BI content will stop loading until a new secret value is generated in Azure and saved in
Curator's Power BI settings.

**Symptoms:**

* Power BI dashboards and reports that previously worked stop loading for all users at once.
* Backend test pages (such as **Power BI** > **Reports**) return authentication errors when fetching workspaces or reports.
* Event logs show errors mentioning `AADSTS7000222`, `Invalid client secret provided`, or `client secret has expired`.
* The **Admin** and **Non-Admin** tabs under <BackendNavPath levelOne="Settings" levelTwo="Power BI Settings" /> may
  still display the previously saved secret, but Azure no longer accepts it.

<Note>
  Curator authenticates to Power BI using a client secret only. Certificate-based authentication is not currently
  supported, so rotating the client secret is the only way to restore access once the existing secret has expired.
</Note>

To rotate the client secret, follow the [Create a Client Secret](/creating_integrations/power_bi_connection/azure_app_setup#create-a-client-secret)
steps in the Azure App Setup guide for the non-admin registered app (and the matching
[Create a Client Secret](/creating_integrations/power_bi_connection/azure_admin_app_setup#create-a-client-secret)
steps in the Azure Admin App Setup guide if you have configured an Admin Registered App). Then enter the new secret
value in Curator as described in the [Curator Connection](/creating_integrations/power_bi_connection/curator_connection)
guide.

***

## Frontend Troubleshooting

Once your backend connection works and you've published Power BI content to Curator's navigation, users should be able
to access it seamlessly.

### Expected User Flow

When everything is configured correctly (following [setup steps 1-4](/creating_integrations/power_bi_connection/azure_app_setup)),
users should experience:

1. **Log in to Curator**
   Using the method configured in your [Authentication Settings](/setup/authentication/overview).

2. **Authenticate with Power BI**
   *(This may happen automatically with SSO)*

3. **Access content**
   Curator displays all accessible content based on platform permissions:

   * Tableau content: controlled by Tableau
   * ThoughtSpot content: controlled by ThoughtSpot
   * Power BI content: controlled by Power BI

   <Note>
     Curator can add additional restrictions but cannot expand access beyond what the source platform allows.
   </Note>

### Debug Frontend Issues

If users see other Curator content but Power BI content is missing from navigation, follow these steps:

#### Verify Power BI Authentication

1. **Enable frontend debug mode**
   Follow the steps to [enable frontend debug mode](/site_administration/performance/troubleshooting_load_times).

   <Tip>Remember to disable this after troubleshooting.</Tip>

2. **Add debug parameter**
   In your browser, add `?debug=1` to the URL
   * Example: `https://curator.yourcompany.com/` becomes `https://curator.yourcompany.com/?debug=1`
     <Note>If URL already has a `?` character in it, use `&debug=1` instead</Note>

3. **Check session data**
   * Look for the debug bar at the bottom of the screen
   * Click **Session** tab
   * Look for a **`powerbi`** > **`user`** entry to ensure it has an "accessToken" value.

4. **Interpret results**
   * **Missing entry:** Authentication failed → Log out and log back into Curator
   * **Valid entry:** Authentication succeeded but Power BI reports no accessible content → Continue to next section

#### Check Power BI API Responses

1. <BackendNavPath levelOne="Settings" levelTwo="Power BI Settings" /> Click on the **Advanced** tab.  Enable the
   **Debug Mode for Power BI** toggle and click save.

   <Warning>
     This increases logging significantly. Set a reasonable **Debug Mode Expiration** (default: 24 hours).
   </Warning>

2. **Clear cache:**
   Click **Clear Cache** button (top right) to force fresh API calls.

3. **Refresh frontend:**
   Go back to Curator's frontend and refresh the page.

4. **Check API logs:**
   If Power BI content still doesn't appear:
   * <BackendNavPath levelOne="Settings" levelTwo="Logs" levelThree="Event Logs" />
   * Look for Power BI API calls
   * Click entries to view detailed responses

5. **Get support:**
   API responses can be complex. Send the details to Curator support for analysis. Meanwhile, verify the user has
   proper access to the Power BI workspace and content in question.

### Redirect URI Mismatch

If you see an error containing `AADSTS50011: The redirect URI specified in the request does not match the redirect URIs
configured for the application`, the Azure app registration is missing the correct redirect URI.

**To fix this:**

1. Go to the [Azure Portal](https://portal.azure.com) and find your app registration
2. Click **Manage** > **Authentication (Preview)** in the left navigation
3. Under the **Web** platform, add a redirect URI using your Curator portal's domain with the `/powerbi` suffix
   * Example: `https://curatorexample.com/powerbi`
4. Save the changes
5. Log out and log back in to Curator to verify the fix

### SSL Certificate Errors

If you encounter an error like this when testing Power BI connections:

```txt theme={null}
GuzzleHttp\Exception\RequestException: cURL error 60: SSL certificate problem: unable to get local issuer certificate
```

This occurs when PHP cannot verify SSL certificates for HTTPS connections to Power BI API and Azure AD OAuth endpoints.
This is most common on Windows servers where the CA certificate bundle is not properly configured.

Curator provides three ways to configure SSL certificate verification through the `POWER_BI_SSL_VERIFY` environment variable:

* **Default**: Standard SSL verification (works on properly configured servers)
* **CA Bundle**: Download and configure a certificate bundle for secure verification
* **Off (*not recommended*)**: Turn off verification entirely (development only)

#### Enabling SSL CA Bundle

This is the most secure solution. You'll download a trusted certificate bundle and configure Curator to use it.

1. **Download the CA bundle:**
   Visit [https://curl.se/ca/cacert.pem](https://curl.se/ca/cacert.pem) and save the file to your server in a location
   readable by your web server.

   <Tip>
     On Windows, a good location is `C:\InterWorks\cacert.pem` or in your Curator installation directory.
     On Linux, consider `/etc/ssl/certs/cacert.pem` or `/var/www/curator/cacert.pem`
   </Tip>

2. **Configure the environment variable:**
   Add or update the following line in your `.env` file with the full path to your downloaded CA bundle:

   ```env theme={null}
   POWER_BI_SSL_VERIFY="C:\InterWorks\cacert.pem"
   ```

3. **Test the connection:**
   Follow the steps in [Test if Backend is Working](#test-if-backend-is-working) to verify the error is resolved.

#### Disable SSL Verification

You can disable SSL verification entirely, but this creates serious security risks.

<Warning>
  Disabling SSL verification exposes your application to man-in-the-middle attacks where an attacker could intercept
  credentials and data. **NEVER use this in production environments.** This should only be used temporarily in isolated
  development environments.
</Warning>

1. **Set the environment variable:**
   Add or update the following line in your `.env` file:

   ```env theme={null}
   POWER_BI_SSL_VERIFY=false
   ```

2. **Test the connection:**
   Follow the steps in [Test if Backend is Working](#test-if-backend-is-working) to verify the error is resolved.