Overview

If you connect Power BI Desktop to your Operational Data Store (ODS) using Private Access and receive a certificate validation error, the issue is typically related to how Power BI validates the database server identity during the TLS/SSL handshake, not to the ODS configuration itself.

TLS certificate validation is a standard security mechanism used by Microsoft technologies to verify the identity of a server before establishing a secure connection.

Because Bizagi does not manage the infrastructure used to connect to ODS, including VPNs, DNS (Domain Name System) services, certificates, Azure networking components, gateways, or Power BI settings, any changes required to resolve this issue must be evaluated and implemented in your environment.

Symptoms

When connecting to ODS from Power BI, you may receive errors indicating that:

•The server name does not match the SSL certificate.

•A secure connection could not be established.

•The certificate presented by the server could not be validated.

These errors indicate that Power BI could not validate the server identity during connection establishment.

Why does this happen?

Power BI validates the certificate presented by the database server and verifies that the server identity matches the name used for the connection. If the database is reached through a networking configuration that causes it to be identified by a different name, Power BI may reject the connection. This behavior is expected and is not specific to ODS.

This situation is commonly associated with Private Access scenarios that use VPNs, VNet Peering, custom DNS resolution, private endpoints, or similar networking components.

Accessing ODS through Private Access

ODS supports Private Access through VPN and VNet Peering.

If you encounter certificate validation errors while using either connectivity option, review the following alternatives.

Option 1: Review DNS and Network configuration

In many cases, certificate validation errors occur because the name used to reach the database differs from the name expected during TLS validation.

Review the DNS and network configuration used to access the ODS database and verify that it complies with your organization's networking standards and Microsoft's recommendations.

If your implementation uses Azure Private Endpoints, see Microsoft's guidance for troubleshooting private endpoint DNS resolution issues.

This approach preserves the certificate validation process and is generally the first alternative to evaluate.

Option 2: Use a Power BI Data Gateway

If you use Power BI to access private data sources, you can evaluate whether a Power BI Data Gateway is appropriate for your environment.

Microsoft provides guidance on deploying and managing gateways for secure access to private data sources.

Since the gateway is a Microsoft component, its deployment, administration, and support are outside the scope of ODS.

Option 3: Evaluate Power BI connectivity alternatives

Microsoft documents additional SQL Server connectivity options that may help address certificate validation issues in specific scenarios, including mechanisms that allow Power BI to trust specific SQL Server instances.

For more information, see the SQL Server connector documentation.

Before implementing any of these alternatives, review their security implications according to your organization's policies and requirements.

Option 4: Use ODS through Public Access

If you cannot establish a working Private Access configuration in your environment, consider using ODS Public Access.

Azure SQL Database supports public connectivity protected through firewall rules that restrict access to authorized IP addresses.

Public Access is a supported ODS connectivity model and may be suitable when the infrastructure requirements needed for Private Access cannot be implemented successfully.

Considerations

•Certificate validation errors do not indicate a failure in ODS. They indicate that the client application could not validate the server identity according to Microsoft's TLS security requirements.

•Since Bizagi does not administer the infrastructure used to connect to ODS, Bizagi cannot determine which alternative is appropriate for your environment or implement the required changes on your behalf. You are responsible for evaluating, testing, approving, and implementing any networking, DNS, certificate, security, gateway, or Power BI configuration changes required to establish connectivity.