Summary
Users experience an "access_denied: AADSTS650057: Invalid resource" error when connecting Power BI (Desktop or Gateway) to Dremio using Microsoft Entra ID (Azure Active Directory) authentication. The error is caused by the Microsoft Power Query for Excel client app (Client ID: a672d62c-fc7b-4e81-a576-e60dc46e951d) not being registered in the organization’s Azure tenant. This public client authentication is necessary for Power BI to access Dremio via Entra ID, and some organizations may restrict this registration for added security.
Reported Issue
Attempts to connect from Power BI Desktop or Gateway to Dremio using Microsoft Entra ID authentication (formerly Azure Active Directory) fail, with the following message:
access_denied: AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: a672d62c-fc7b-4e81-a576-e60dc46e951d (Microsoft Power Query for Excel). Resource value from request: <UUID>. Resource app ID: <UUID>. List of valid resources from app registration: . Trace ID: <UUID> Correlation ID: <UUID> Timestamp: 2024-08-29 13:17:51Z.
The UUIDs will depend on your environment, but the client app ID (a672d62c-fc7b-4e81-a576-e60dc46e951d) and the error ID at the start of the message (AADSTS650057) should be the same as show here.
Relevant Versions
Microsoft Power BI Desktop (December 2021+), which includes Dremio as a certified connector. This will be the "Dremio Software" or "Dremio Cloud" connector.
Troubleshooting Steps
The error message will appear from the Dremio Software or Dremio Cloud connector windows when using Power BI. There should be no need to view Power BI logs or Dremio logs.
Cause
The problem is not actually with the Dremio application, but rather with application registrations in your Azure tenant.
In the authorization flow, Power BI is a client that authenticates users with Entra ID and uses the resulting access token to gain access to the Dremio resource (i.e. the Dremio application). You will have configured Dremio to allow Power BI access, but that client also needs to have been registered to your Azure tenant (i.e. Entra ID). As the Microsoft documentation describes, the client ID in the error, a672d62c-fc7b-4e81-a576-e60dc46e951d (Microsoft Power Query for Excel), is the "public client, used in Power BI Desktop and the gateway". While many organizations will already have this "global" public client registered, your company may have greater security restrictions in place for its Azure tenant, and this client app may not be registered.
Steps to Resolve
In your Azure tenant, register the Microsoft Power Query for Excel client app. This may require approval from your Azure admin.