Network and Microsoft Endpoints¶
The connections MetaMiner accepts and the Microsoft endpoints it calls, so you can request firewall and proxy rules before you install.
Inbound to the MetaMiner server host¶
| Port | Protocol | From | Used for | Change it in |
|---|---|---|---|---|
| 49714 | TCP (HTTP/WebSocket, optional TLS) | Client workstations, browsers, the MetaMiner Administrator | MetaMiner Client connections, Usage dashboards, configuration saves | MMA Preferences > Settings... > General, Server Port (port in config.json) |
| 49614 | TCP (PostgreSQL) | Only hosts that query the MetaMiner Database directly (reporting tools, ODBC) | Embedded MetaMiner Database | MMA Configure MMDB |
Microsoft never connects to MetaMiner. No inbound rule from the internet is needed.
All other MetaMiner ports listen on the local host only and need no firewall rule:
| Port | Process | Note |
|---|---|---|
| 49717 | MetaMiner Web Apps | Reached by browsers through port 49714 |
Keep the database port closed unless you need it
Clients and browsers never connect to the MetaMiner Database. Open 49614 only for hosts that query it directly. See Network Exposure.
Client auto-detection of servers (UDP multicast)
The Connection Manager in the client can find MetaMiner Servers on the local network by UDP multicast to group 228.5.6.7. The server answers on UDP ports 49352, 54215, 58632 or 63759; the client listens on 49752, 55447, 59429 or 64186. Firewalls often block this. If auto-detection finds nothing, type the server host and port instead; no multicast rule is required.
Outbound from the MetaMiner server host¶
All calls to Microsoft are HTTPS on TCP 443 with TLS 1.2 or 1.3. The hosts depend on the Endpoint Set you choose for the Power BI environment in the MetaMiner Administrator.
| Endpoint Set | Sign-in | Power BI REST | Fabric REST | Microsoft Graph |
|---|---|---|---|---|
| Commercial (default) | login.microsoftonline.com |
api.powerbi.com |
api.fabric.microsoft.com |
graph.microsoft.com |
| US Government | login.microsoftonline.com |
api.powerbigov.us |
api.fabric.microsoft.us |
graph.microsoft.us |
| US Government High | login.microsoftonline.us |
api.high.powerbigov.us |
api.fabric.high.microsoft.us |
graph.microsoft.us |
| US Government Military | login.microsoftonline.us |
api.mil.powerbigov.us |
api.fabric.mil.microsoft.us |
dod-graph.microsoft.us |
| Destination | Used for | Required |
|---|---|---|
| Sign-in host | Access tokens for the registered application | Yes |
| Power BI REST host | Workspaces, scans, activity, refreshes, apps, capacities, Capacity Metrics queries, dataflow definitions, report export, Manage Access, restore | Yes |
| Fabric REST host | Gateways, connections, Fabric items, item definitions, backup and restore | Yes |
| Microsoft Graph host | Entra users, groups, memberships, applications, licenses; principal search in Manage Access | Yes for Entra features (validated by Test Connection) |
| External PostgreSQL (if not embedded) | MetaMiner Database, PostgreSQL default port 5432 | Only with an external MMDB |
| SMTP server | Notification e-mail, backup job results | Optional |
Token audience is not a firewall destination
MetaMiner requests Power BI tokens for the resource https://analysis.windows.net/powerbi/api (Government clouds: analysis.usgovcloudapi.net with high. or mil. prefixes). That name identifies the API in the token. MetaMiner does not connect to it.
Proxies and TLS inspection¶
A proxy that decrypts and re-signs TLS traffic to the Microsoft hosts breaks the connection unless the MetaMiner server trusts the proxy's certificate. Exempt the hosts above from TLS inspection.
TODO: document the supported outbound proxy configuration for Microsoft calls
The MetaMiner Administrator has no proxy field for Power BI. The server's HTTP client uses Java's default proxy selection. Confirm with engineering whether customers should set https.proxyHost and https.proxyPort in server\MetaMinerServer.properties, whether proxy authentication is supported, and test it before publishing steps.
Client workstations¶
| Destination | Port | Used for |
|---|---|---|
| MetaMiner Server | 49714 TCP | All client functions |
login.microsoftonline.com |
443 | Delegated sign-in in the browser (Commercial cloud) |
app.powerbi.com (Government: app.powerbigov.us, app.high.powerbigov.us, app.mil.powerbigov.us) |
443 | Open in Browser from the Power BI Explorer |
api.fabric.microsoft.com, onelake.dfs.fabric.microsoft.com |
443 | Export of Meta Query results to a Fabric lakehouse, sent directly from the client |
The delegated sign-in returns to the client through http://localhost on the workstation itself. No inbound rule is needed for it.