FortiSASE
FortiSASE delivers both a consistent security posture and an optimal user experience for users working from anywhere. Secure your hybrid workforce by closing security gaps, plus simplify operations.
jiahoong112
Staff
Staff
Article Id 417976
Description This article describes the issue of Microsoft 365 applications failing to poll the Power BI backend for information through FortiSASE Secure Web Gateway (SWG) for SSO users and provides a step-by-step guide to resolve this issue by creating a custom PAC file and exempting Power BI FQDNs from the Secure Web Gateway proxy.
Scope FortiSASE.
Solution

To resolve the issue of Microsoft 365 applications (Microsoft Word, Excel, etc.) failing to poll the Power BI backend for information through FortiSASE Secure Web Gateway, follow these steps:

  1. Identify the Power BI FQDNs that need to be exempted from the Secure Web Gateway proxy. These can be found Microsoft Power BI resource
  2. Refer to this link to configure the PAC file for exempting Microsoft 365 applications, including Microsoft Teams, from SWG: Technical Tip: FortiSASE SWG SSO users unable to connect/access Microsoft 365 applications Microsoft...
  3. Create a custom PAC file that excludes the identified Power BI FQDNs from the Secure Web Gateway proxy. Refer to the below for example.

Custom PAC File:

 

function FindProxyForURL(url, host)

{

var direct = "DIRECT";

var proxyServer = "PROXY <FortiSASE-SWG-Turbo-FQDN:SWG-Port>";

 

if  (shExpMatch(host, "*.analysis.windows.net")

    || shExpMatch(host, "*.pbidedicated.windows.net")

    || shExpMatch(host, "*.powerquery.microsoft.com")

    || shExpMatch(host, "api.powerbi.com")

    || shExpMatch(host, "appsource.microsoft.com")

    || shExpMatch(host, "content.powerapps.com")

    || shExpMatch(host, "dc.services.visualstudio.com")

    || shExpMatch(host, "*.s-microsoft.com")

    || shExpMatch(host, "*.osi.office.net")

    || shExpMatch(host, "*.msecnd.net")

    || shExpMatch(host, "store.office.com")

    || shExpMatch(host, "store-images.s-microsoft.com")

{

    return direct;

}

return proxyServer;

}