Power BI

Applies to: Power BI Premium Per User (PPU), Power BI Premium Capacity, Power BI Pro, Power BI Shared Capacity, Fabric Capacity, Fabric Trial Capacity

This guide sets up the Power BI connector using a service principal, Microsoft's recommended method for automated, application-level access. Datalogz reads metadata through Power BI's read-only admin APIs; it never accesses the data inside your reports.

You will complete four steps: register an application in Microsoft Entra, add it to a security group, allow that group in your Power BI tenant, and create the connector in Datalogz Control Tower. You will need someone with Microsoft Entra admin rights and a Power BI tenant admin.

Step 1: Register an application in Microsoft Entra

1. Register a new application in the Microsoft Entra portal. Note the Application (client) ID and Directory (tenant) ID shown on the Overview screen; you will need both later.

2. Under Manage, select Certificates & secrets, then New client secret.

3. Enter a description and leave the expiry at the recommended 180 days. You can choose a different duration, but when the secret expires you will need to create a new one and re-authenticate the connector.

4. Click Add and copy the secret Value immediately. This is your Application Secret Value. It cannot be viewed again after you leave the page.

The registered application must not have any admin-consent-required permissions set on it. Microsoft requires a clean app registration for service principal authentication.

Step 2: Create a security group and add the application

1. In the Microsoft Entra portal, create a new group with Group type: Security.

2. Enter a Group name. You will need it for the tenant configuration in the next step.

3. Under Members, search for the application you registered in Step 1, select it, and confirm. The application should now appear under Direct members.

Step 3: Allow the group in your Power BI tenant

1. From the Power BI admin portal, open Tenant settings:

   1. Under Developer settings, find Service principals can call Fabric public APIs, select Specific security groups, enter your security group, and click Apply.

   2. Under Admin API settings, do the same for each of the following: Service principals can access read-only admin APIs, Enhance admin APIs responses with detailed metadata, and Enhance admin APIs responses with DAX and mashup expressions.

2. If you want to trace lineage to your gateway, go to Manage Connections and Gateways, and do the following:

   1. Click On-premises data gateways.

   2. Search for the name of the security group.

   3. Change role to Admin and click Share.

Power BI tenant configuration changes can take 15 minutes or longer to apply.

Step 4: Create the connector in Control Tower

1. Sign in to Datalogz Control Tower and go to Settings > BI Connectors.

2. Click New Connector and select Power BI.

3. Select Connect using a Service Principal (SP) and click Connect.

4. Enter the Directory (Tenant) ID, Application (Client) ID, and Application Secret Value from Step 1, then click Connect.

5. Enter a Connector Name, select the snapshot frequency (for example Daily or Weekly), choose which workspace types to monitor (Premium, Shared, and/or Personal), and select whether to capture Activity and Capacity metadata.

6. Click Next, then Confirm and Finish.

Optional: capacity monitoring

Capacity monitoring is optional but highly recommended if you run Premium or Fabric capacities. It lets Control Tower track capacity usage with the application you registered above.

1. In the Power BI admin portal, under Tenant settings > Integration settings, find Semantic Model Execute Queries REST API, select Specific security groups, enter your security group, and click Apply.

2. Install the Microsoft Fabric Capacity Metrics app: in Power BI, go to Apps, search for it and add it, then open the Microsoft Fabric Capacity Metrics workspace it creates, go to Manage Access, and grant Admin permissions to your security group. Run the app once to start data flowing.

3. Note the ID of the Fabric Capacity Metrics semantic model. You can find it in the URL when viewing the semantic model in your browser. Enter it in the capacity settings of your Power BI connector.

For questions or help with this setup, contact [e-mail].