Unable to process Azure SQL Data Source using a Service Account

[agherardi97]

Hello
Unsure if this is an issue or something I can't figure out, so I'm using this forum instead of the issues section.

I am trying to use TE3 to create a SSAS model that needs to be deployed on AAS and use AzureSQL as a datasource. I want to connect to the AzureSQL using a Service Account (app registration on Azure) but regardless of what I do, when I process the tables I get error:

Error "The JSON DDL request failed with the following error: Failed to save modifications to the server. Error returned: 'Windows authentication has been disabled in the current context.. The exception was raised by the IDbCommand interface.

Additional details:

-TE License: evaluation (which should be equivalent to the enterprise)
-AAS tier: B1 (location: north europe)
-Azure SQL DB: Free - General Purpose - Serverless: Gen5, 2 vCores (location: north italy)
-my service account AZSQL-DevOps-ServicePrincipal is added in the AzureSQL DB as a user, using commands:

USE master;
GO

CREATE LOGIN [AZSQL-DevOps-ServicePrincipal]
FROM EXTERNAL PROVIDER;
GO

USE mydb;
GO

-- Create a user from the server-level login
CREATE USER [AZSQL-DevOps-ServicePrincipal]
FROM EXTERNAL PROVIDER;
GO

-- Grant membership in db_datareader role (for read access to all tables)
ALTER ROLE db_datareader
    ADD MEMBER [AZSQL-DevOps-ServicePrincipal];
GO

If I login using the Service Principal information to the AzureSQL DB, I am able to query the tables running SELECT

So it seems my Service Principal is correctly created and able to log into the database and retrieve data.

When creating my ssas model, I do the following:

1) I create a new model flagging option to use a workspace DB

2) I connect to my server using MFA (I have a ServicePrincipal created to administer the AAS specifically when deploying through YAML pipelines, but for local development authenticating with my user should be ok):

3)I create a new workspace DB on my AAS server

4. Now I start creating my datasource. I click on Data Souces -> Import Tables -> use Structured (Power Query) Data Source -> then I select Azure SQL and connect using Service Account
   

5. I then insert my ServicePrincipal credentials using the format clientid@tenantid + secret value for the password. And after that select -> Choose a list of available table and view
   

6)I am able to view the tables and even preview them

7. I import and create the tables in my model and in the workspace DB. After this, I expect to be able to process the tables. However, if I launch the process command:

8. If I use SSMS to connect to my AAS server I see the workspace DB created
   

And if script the data source object, this is the object definition:

{
  "createOrReplace": {
    "object": {
      "database": "testing_newmodel",
      "dataSource": "New Data Source"
    },
    "dataSource": {
      "type": "structured",
      "name": "New Data Source",
      "connectionDetails": {
        "protocol": "tds",
        "address": {
          "server": "servername",
          "database": "dbname"
        }
      },
      "credential": {
        "AuthenticationKind": "ServiceAccount"
      }
    }
  }
}

I also tried re-deploying the model and adding the datasource credentials (clientid@tenantid and secretvalue) directly in the username and password property of the model. I still get the same error, although if I script out the datasource I get:

{
  "create": {`{
  "create": {
    "parentObject": {
      "database": "testing_newmodel"
    },
    "dataSource": {
      "type": "structured",
      "name": "New Data Source",
      "connectionDetails": {
        "protocol": "tds",
        "address": {
          "server": "servername",
          "database": "dbname"
        }
      },
      "credential": {
        "AuthenticationKind": "ServiceAccount",
        "Username": "clientid@tenantid"
      }
    }
  }
}

ClientID and TenantID values are the actual values, I just changed them here.

Lastly, I tried using a TMSL script to update the datasource esplicitly putting the username and password in the credentials part, but it stills errors out with the same error.

I have also tried deploying using a deployment pipeline with TE and then running the TMSL script as the last part, doing exactly the same which means replacing the datasource object and using authenticationkind = 'ServiceAccount', but it still returns the same error. This is actually the first thing I did since this was all part of a deployment pipeline which used service principals both to connect to AAS and deploy (which I am able to do) and to connect to the azure sql datasource and process (which I am unable)

Any help would be appreciated.
Thanks