Is there an alternative to connecting to Azure Blob through Analysis Services via Account Key?

Question

Currently, we use Azure Analysis Services to deploy data models that users can access via Excel or Power BI. These models sometimes retrieve data from Azure Blob Storage, where we have built our data lake, authenticating via Account Key.

Due to a company policy, Account Keys are being disabled on all storage accounts, and there seems to be no alternative authentication methods to connect to Azure Blob Storage.

The only solution that comes to mind is to write the data to our Azure SQL Server database instead. However, the performance is not great when reading rows on Analysis Services compared to getting the data from the Blob.

Has anyone encountered a similar problem or have any alternative solutions? Any insight is appreciated. Thanks!

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

Yes, there are alternative authentication methods for connecting Azure Analysis Services (AAS) to Azure Blob Storage without using the Account Key. Since your company is disabling Account Keys, consider these options:

• Use ADLS Gen2 with MI (Recommended)

Azure Analysis Services does not support MI authentication directly. However, you can use ADLS Gen2 instead of Blob Storage.

Solution:

Migrate your data from Azure Blob to ADLS Gen2 (which is built on Blob Storage). Configure RBAC for the Azure Analysis Services (AAS) MI. Assign "Storage Blob Data Reader" role to AAS on the Data Lake.

• Use Azure Synapse Analytics / Azure SQL as an Intermediary

If you must keep Analysis Services, consider loading data into Azure Synapse Analytics (Dedicated Pool) or Azure SQL DB. Synapse supports Managed Identity authentication to access Blob Storage. AAS can then connect to Synapse SQL Pool or Azure SQL as a data source.

• Use Azure Data Factory to Load Data to SQL or Synapse

If AAS cannot read from Blob Storage directly without an Account Key, use ADF to move the data to a SQL based store (Synapse or Azure SQL DB).

Then, Analysis Services can read from this source.

• Use Power BI Premium Instead of AAS

If you're open to Power BI Premium (PBI PPU or PBI Premium Capacity), it supports Direct Lake mode, which allows faster access to Azure Data Lake Gen2 without needing to go through a SQL-based store.

---

Best Approach:

• If you can migrate to ADLS Gen2, do that and use RBAC for authentication.
• If not, use Synapse or Azure SQL as an intermediary, but expect some performance trade-offs.
• If performance is critical, consider Power BI Premium Direct Lake.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.