-
Notifications
You must be signed in to change notification settings - Fork 2
Authentication
Every Dataverse PowerTools project connects to a Dataverse environment. This guide walks through the two ways to sign in, where your credentials are stored, and how to switch environments or recover a broken connection.
In short: pick Interactive sign-in for day-to-day coding, or Service principal for shared/CI-style setups. Secrets are kept in VS Code secret storage — never in a file you commit.
- An account or app registration with access to a Dataverse environment.
- For the service-principal flow, the app must be an Application User in the
environment with a security role — see
Create an application user.
You can create the service principal with:
pac admin create-service-principal --environment <env-url>
You pick the method the first time you initialise a project, and can change it any time with Dataverse PowerTools: Update Dataverse Authentication.
| Method | Best for | What you provide |
|---|---|---|
| Interactive sign-in | Individual developers | A browser sign-in — no app registration needed |
| Service principal (client secret) | Shared machines, automation-style setups | Tenant ID, application (client) ID, client secret |
- Run Update Dataverse Authentication (or initialise a new project) and choose Interactive sign-in.
- A browser window opens — sign in with your Dataverse account. The extension uses Microsoft's well-known Power Platform sample application, so no app registration is required.
- Back in VS Code, pick your environment from the discovered list.
- Pick a solution — the publisher prefix is inferred from it automatically.
The sign-in token is cached in VS Code secret storage, so reopening the project reconnects silently — no browser prompt on every launch.
- Run Update Dataverse Authentication and choose Service principal (client secret).
- Enter the Tenant ID, Application (client) ID, and Client secret.
- Pick your environment from the discovered list. (Service-principal discovery only sees environments where the app is an Application User; if the list is empty, you'll be asked to type the environment URL.)
- Pick a solution — the prefix is inferred.
Verify: the status bar shows a $(database) icon with your environment URL, and
the Dataverse PowerTools output channel (Show Log) logs Connected to Dataverse.
- Secrets (client secret / interactive token cache) live in VS Code secret storage — an OS-backed keychain — and are never written to disk in the project.
- Only the non-secret connection base (auth type, environment URL) is written to
dataverse-powertools.json, so that file is safe to commit.
This is why a teammate cloning your repo still has to authenticate once: the settings file has the environment, but the secret is local to your machine.
To move a project between environments (e.g. dev → test) without re-entering credentials, run Dataverse PowerTools: Switch Dataverse Environment. You'll pick a new environment from the discovered list; the same sign-in is reused and the solution prefix is re-inferred.
If the extension didn't reconnect on load, a token expired after VS Code was open a long time, or operations start failing with auth errors, run Dataverse PowerTools: Refresh Dataverse Connection to establish a fresh connection using your existing credentials. For interactive sign-in, this re-authenticates without asking for the environment or solution again.
| Symptom | Fix |
|---|---|
| Status bar shows Dataverse Not Connected on load | Run Refresh Dataverse Connection. If it persists, run Update Dataverse Authentication and re-enter details. |
Error refreshing authorization token |
Token expired or the secret changed — Refresh Dataverse Connection, or re-run Update Dataverse Authentication. |
| Environment list is empty (service principal) | The app isn't an Application User in that environment — add it (docs), or type the environment URL manually when prompted. |
AADSTS500011: resource principal … not found in the tenant |
The environment URL / tenant don't match — double-check the environment URL and tenant ID. |
Use Dataverse PowerTools: Show Log to see the full connection log while troubleshooting.