API Permissions¶
The exact Microsoft Graph application permissions the registered application needs, why MetaMiner needs no Power BI API permissions on it, and how to grant admin consent.
How it works¶
The MetaMiner Server requests two app-only tokens with the client credentials flow, each for the .default scope of one resource:
| Token | Scope requested | What authorizes it |
|---|---|---|
| Power BI and Fabric | https://analysis.windows.net/powerbi/api/.default (Government clouds use their own resource) |
Fabric tenant settings scoped to a security group that contains the application. See Tenant Settings. |
| Microsoft Graph | https://graph.microsoft.com/.default (Government clouds use their own Graph host) |
Graph application permissions on the app registration, with admin consent |
So the two halves are enabled in different places: Power BI and Fabric access comes from tenant settings, Graph access comes from API permissions on the app registration.
Microsoft Graph application permissions¶
Grant either the umbrella permission or all five granular permissions. Test Connection reads the roles in the Graph token and checks exactly this.
| Option | Permissions (type: Application) | Test Connection step |
|---|---|---|
| Umbrella | Directory.Read.All |
Directory.Read.All |
| Granular (least privilege) | User.Read.All, Group.Read.All, GroupMember.Read.All, Application.Read.All, LicenseAssignment.Read.All |
One step per permission |
Choose one option, not both. With Directory.Read.All present, Test Connection does not check the five granular permissions.
| Permission | MetaMiner reads |
|---|---|
User.Read.All |
Users: display name, user principal name, object ID, account state; user principal search in Manage Access |
Group.Read.All |
Groups and their properties; group search in Manage Access |
GroupMember.Read.All |
Group membership, including nested groups |
Application.Read.All |
Service principals and application registrations, so that access held by apps shows a name instead of an ID |
LicenseAssignment.Read.All |
Subscribed license products and the licenses assigned to users and groups |
All Graph calls are reads (users, groups, servicePrincipals and applications with change tracking, and subscribedSkus). MetaMiner requests no Graph write permission.
Graph is part of the standard setup
Test Connection must pass every step before the MetaMiner Administrator saves the environment as enabled, and the Graph steps are among them. Without Graph permissions you can only save the environment disabled.
TODO: decide and document a supported Power BI-only (no Graph) configuration
Infolytik's security posture guide describes Graph as optional, but the current Test Connection fails without it and an environment saved with Save Anyway is disabled. Product decision needed: either allow skipping the Graph checks, or remove "optional" from customer material.
Power BI and Fabric API permissions¶
Do not add Power BI Service or Fabric application permissions to the app registration for MetaMiner. MetaMiner does not request or check them. The admin APIs are unlocked by the tenant settings instead.
TODO: re-check Microsoft's guidance on Power BI permissions for read-only admin API service principals
Microsoft Learn ("Enable service principal authentication for read-only admin APIs") has stated that the application must not have admin-consent-required Power BI permissions. Confirm the current wording before publishing it as a requirement. Older Infolytik setup notes listed Power BI application permissions such as Tenant.Read.All; those are not used.
Steps¶
- In the Microsoft Entra admin center, open your app registration and select API permissions.
- Click Add a permission, select Microsoft Graph, then Application permissions.
- Search for and select
Directory.Read.All(or the five granular permissions), then click Add permissions. - Click Grant admin consent for your tenant and confirm. The Status column shows a green "Granted" mark for each permission.
- Remove any permission MetaMiner does not need, for example a default delegated
User.Readyou do not use elsewhere.
Image of the app registration API permissions page with Directory.Read.All (Application) granted for the tenant
../images/microsoft-setup/entra-api-permissions-granted.png
TODO: re-check the API permissions page labels against current Microsoft Learn
Source to check: Microsoft Learn, "Configure an application to access a web API" and "Grant tenant-wide admin consent".
Delegated permissions¶
Delegated permissions for people who sign in from the MetaMiner Client belong to a separate application published by Infolytik, not to your app registration. See Delegated User Sign-In.
Verify¶
- Test Connection in the MetaMiner Administrator shows Graph API Token creation and Directory.Read.All (or the five granular steps) as passed.
Troubleshooting¶
Graph API Token creation passes but a permission step fails
The permission was added but admin consent was not granted, or it was added as a delegated permission. Add it as an Application permission and grant admin consent. A new consent can take a few minutes to appear in tokens.
Graph API Token creation fails while PBI API Token creation passes
The Graph endpoint is blocked, or the Endpoint Set does not match your cloud. See Network and Microsoft Endpoints.