Microsoft Permissions Overview¶
Which Entra application permissions, Fabric tenant settings, workspace roles and user sign-ins each MetaMiner feature needs, so you can approve exactly what you use.
Two identities¶
MetaMiner uses two separate Microsoft identities. They never borrow each other's rights.
| Identity | What it is | Used for | Can it change your tenant? |
|---|---|---|---|
| Service principal (app-only) | The application you register in Microsoft Entra ID, signing in with its client ID and client secret | The scheduled collection, Test Connection, Capacity Metrics, backup jobs, .pbix export | No changes during collection. Backup reads content; it changes nothing. |
| Signed-in user (delegated) | A person who signs in to Power BI from the MetaMiner Client with their own Microsoft account | Manage Access, restore, restore of deleted workspaces, granting the application access for backup, lakehouse export | Yes, but only what that person is allowed to do in Microsoft |
Permissions by feature¶
| Feature | Entra application (service principal) | Fabric tenant settings (scoped to a security group with the application) | Workspace role | Signed-in user |
|---|---|---|---|---|
| Read-only inventory: workspaces, items, Fabric item inventory, scans with lineage and expressions, activity, refreshes, apps, capacities | Client secret. No Power BI API permissions. | Service principals can access read-only admin APIs; Enhance admin API responses with detailed metadata; Enhance admin API responses with DAX and mashup expressions | None. The admin APIs cover every workspace. | Not needed |
| Gateways, connections | - | Service principals can use Fabric APIs | None | Not needed |
| Entra users, groups, licenses (Entra Users/Groups tab, license dashboards, principal search in Manage Access) | Microsoft Graph application permission Directory.Read.All, or the five granular permissions, with admin consent |
- | - | Not needed |
| Fabric item and dataflow definitions | - | Service principals can use Fabric APIs | Admin, Member or Contributor on the workspaces whose definitions you want | Not needed |
| Capacity Metrics | - | Semantic model Execute Queries REST API; service principals allowed to use Power BI APIs | Contributor or Admin on the workspace of the Capacity Metrics app | Not needed |
| .pbix export from the Power BI Explorer | - | Service principals allowed to use Power BI APIs | A role on the workspace of the report | Not needed |
| Backup | - | Service principals can use Fabric APIs | Contributor on each backed-up workspace. MetaMiner can grant it for you. | To grant access: workspace Admin, or Fabric Administrator |
| Restore from a backup archive | - | - | - | Signed in, with Admin, Member or Contributor on the target workspace |
| Manage Access (add, change, remove workspace access) | - | - | - | Signed in, with the right to manage access on that workspace |
| Tenant Admin View, restore deleted workspaces | - | - | - | Signed in, with the Fabric Administrator role |
| Export Meta Query results to a Fabric lakehouse | - | - | - | Signed in, with write access to the lakehouse |
TODO: re-check every tenant setting label against current Microsoft Learn
Microsoft renames Fabric admin portal settings. The labels above follow what MetaMiner's Test Connection reports and the current setup guide. In particular, confirm whether "Allow service principals to use Power BI APIs" and "Service principals can use Fabric APIs" are still two separate settings in your tenant, and the current name of "Semantic model Execute Queries REST API" (formerly "Dataset Execute Queries REST API").
TODO: confirm the minimum workspace role for .pbix export and dataflow definitions with the service principal
Source to check: Microsoft Learn for Reports - Export Report In Group and Dataflows - Get Dataflow, then test with a Viewer role.
Delegated permissions for signed-in users¶
Each action asks Microsoft only for the permission it needs, at the moment it runs. An Entra administrator can consent once for the whole tenant. Details: Delegated User Sign-In.
| Action | Delegated permission |
|---|---|
| Sign in, list workspace access | Power BI Workspace.Read.All |
| Add, change or remove workspace access; grant backup access | Power BI Workspace.ReadWrite.All |
| Restore from an archive | Power BI Workspace.ReadWrite.All, plus as needed Dataflow.ReadWrite.All, Content.Create, Dataset.ReadWrite.All, Capacity.Read.All |
| Restore a deleted workspace; Tenant Admin View | Power BI Tenant.ReadWrite.All |
| Export to a Fabric lakehouse | Fabric Catalog.Read.All and Item.ReadWrite.All; Azure Storage user_impersonation |
MetaMiner's own permission¶
When MetaMiner user security is on, backup, restore, the Tenant Admin View and the Entra Users/Groups tab also need the MetaMiner permission Tenant Admin for the Power BI environment. Microsoft still checks the signed-in user independently. See Permissions Reference.