Configure cross-origin resource sharing

In some instances, when you sign in to ArcGIS for Power BI with an ArcGIS Enterprise account, a valid ArcGIS Enterprise URL does not connect and the following error appears:

Error signing in to an ArcGIS Enterprise account from Power BI

This error applies to ArcGIS Enterprise accounts only. By default, an ArcGIS Enterprise portal allows cross-domain requests via Cross-Origin Resource Sharing (CORS). This means a JavaScript client such as a web application hosted on any domain can connect to your portal's resources.

To restrict requests from specific domains for JavaScript applications, an ArcGIS Enterprise administrator can configure the portal to only allow certain domains by adding domain names to the list of allowed origins in the ArcGIS Enterprise portal's security settings. This reduces the possibility that an unknown application could send malicious commands to your web services.

Depending on the version of ArcGIS Enterprise and the Power BI connection you are using, an ArcGIS Enterprise administrator may need to enable and configure CORS in order for ArcGIS for Power BI to work.

Allow origins for the Power BI service (app.powerbi.com)

To sign in to ArcGIS Enterprise from the Power BI service (app.powerbi.com), an ArcGIS Enterprise administrator must configure the Allow origins settings to allow the following addresses:

  • https://arcgis.com
  • https://app.powerbi.com
  • https://powerbi.com

Allow origins settings for ArcGIS Enterprise

For more information, see Restrict cross-domain requests to your portal.

Allow origins for Power BI Desktop

To sign in to ArcGIS Enterprise from Power BI Desktop, an ArcGIS Enterprise administrator must configure the Allow origins settings to allow the following addresses:

  • https://arcgis.com
  • https://app.powerbi.com
  • https://powerbi.com
  • http://pbi.microsoft.com
  • https://pbi.microsoft.com
  • ms-pbi://pbi.microsoft.com
  • https://ms-pbi.pbi.microsoft.com

The steps to perform this configuration vary depending on your version of ArcGIS Enterprise.

ArcGIS Enterprise 10.7.1 to 10.9

To configure the allowed origins on ArcGIS Enterprise 10.7.1 to 10.9, do the following:

  1. Verify that you are signed in to your ArcGIS Enterprise organization and that you have privileges to manage the organization.
  2. Sign in to the sharing API using the URL https://webadaptorhost.domain.com/webadaptorname/sharing/rest.

    Note:
    To complete this step, HTML access to the sharing API must be enabled. On many secured environments, HTML access to the sharing API is restricted. To enable HTML access to the sharing API, the disableServicesDirectory property under https://webadaptorhost.domain.com/webadaptorname/portaladmin/security/config must be set to false.

  3. Once signed in, access https://webadaptorhost.domain.com/webadaptorname/sharing/rest/portals/self.
  4. Scroll to the bottom of the page and click Update.
  5. On the newly loaded page, scroll down and find the Allowed Origins box.

    Origins are comma separated without any spaces, quotes, or square brackets.

  6. Copy the following text into the Allowed Origins box to add the Power BI origins.

    https://arcgis.com,https://app.powerbi.com,https://powerbi.com,http://pbi.microsoft.com,https://pbi.microsoft.com,ms-pbi://pbi.microsoft.com

  7. Click Update Organization.

The Power BI origin is added to the allowed origins. The changes take effect immediately, without the need to restart the portal.

ArcGIS Enterprise 10.9.1 and later

To configure the allowed origins on ArcGIS Enterprise 10.9.1 and later, administrators can follow the instructions in Restrict cross-domain requests to your portal. Signing in to the sharing API is not required.