Connector extensibility in Power BI

Custom connectors in Power BI extend connectivity so you can use data from hundreds of sources. This article covers connector extensibility capabilities, certified and uncertified connectors, security settings, and signing options to help you build, deploy, and use custom connectors safely in Power BI Desktop.

Power BI connects to data through existing connectors and generic sources like ODBC, OData, OLE DB, Web, CSV, XML, and JSON. Developers add new sources with custom data extensions called custom connectors. Microsoft certifies and distributes some as certified connectors.

Develop custom connectors (Power Query SDK)

Use the Power Query SDK in Visual Studio Code to author, validate, and package custom connectors:

• Install from the Visual Studio Marketplace: Power Query SDK for Visual Studio Code.
• Explore samples and advanced patterns in the GitHub repository: microsoft/DataConnectors on GitHub.
• Use the SDK to:
  • Create and edit .pq and .m source files with syntax coloring and schema validation
  • Build a .mez package (compressed connector bundle)
  • Run test queries with the built-in query runner
  • Validate navigation tables, authentication flows, and data source kinds

To use an uncertified custom connector that you or someone else develop, adjust your Power BI Desktop security settings to let extensions load without validation or warning. These extensions can ignore privacy levels and handle credentials, and can send them over HTTP, so enable this setting only when you fully trust your custom connectors.

Alternatively, the developer signs the connector with a certificate and gives you the details you need to use it without changing your security settings. For more information, see Trusted third-party connectors.

Custom connectors

Uncertified custom connectors range from small, business-critical APIs to large, industry-specific services that don't yet have a Microsoft connector. Vendors distribute many connectors. If you need an industry- or business-specific connector, contact the vendor.

To use an uncertified custom connector:

1. Copy the connector file (.pq, .pqx, .m, or .mez) into your user Documents–scoped custom connectors folder:

   [Documents]\Microsoft Power BI Desktop\Custom Connectors

   If the folder doesn't exist, create it.

   Note

   If your organization enables OneDrive sync or Known Folder Move, the effective Documents path might be redirected. For example: C:\Users<user>\OneDrive - Fabrikam\Documents Don’t assume %USERPROFILE%\Documents. To reliably locate the correct folder in PowerShell:

   [Environment]::GetFolderPath('MyDocuments')
   Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'Microsoft Power BI Desktop\Custom Connectors'
   

   Place the connector files there, then restart Power BI Desktop.

2. In Power BI Desktop, go to File > Options and settings > Options > Security to adjust the data extension security settings.

3. Under Data Extensions, select (Not Recommended) Allow any extension to load without validation or warning.

4. Select OK, then restart Power BI Desktop.

The default Power BI Desktop data extension security setting is (Recommended) Only allow Microsoft certified and other trusted third-party extensions to load. With this setting, if uncertified custom connectors are on your system, the Uncertified Connectors dialog box appears at startup and lists the connectors that can't load.

If you don't need these connectors in this session, select OK to dismiss the error.

Prevent the error by changing your Data Extensions security setting or removing the uncertified connectors from your Custom Connectors folder.

Signing custom connectors

Signing a .mez package with a trusted code signing certificate lets users load the connector without enabling the "allow any extension" setting.

High-level steps

1. Obtain a code-signing certificate (internal PKI or a public CA). Avoid deprecated test tools for pro1. Run the following signtool.exe command (Windows SDK) to sign the .mez file.

   signtool sign /tr http://timestamp.sectigo.com /td SHA256 /fd SHA256 /a YourConnector.mez
   ```gntool sign /tr http://timestamp.sectigo.com /td SHA256 /fd SHA256 /a YourConnector.mez
   

2. Distribute the signed .mez to users by placing it in the Custom Connectors folder.

3. Renew certificates before they expire, and re-sign each updated build.

Effect on load behavior

• A properly signed connector from a trusted publisher loads under the recommended security setting.
• Unsigned or self-signed connectors trigger the uncertified dialog unless the permissive setting is enabled.

For certificate trust requirements and edge cases (root store, intermediate chains, revocation), see Trusted third-party connectors.

Certified connectors

Microsoft certifies a limited set of custom data extensions. Microsoft distributes these connectors but isn't responsible for their performance or continued functionality. The third-party developer maintains and supports the connector.

In Power BI Desktop, certified third-party connectors appear in the Get Data dialog box with generic and common connectors. You don't need to change security settings to use certified connectors.

Troubleshooting custom connector issues

The following table lists common issues you may encounter when working with custom connectors and provides guidance for resolving them.

Related content

• See Power Query Connector Certification to certify a custom connector.