Delegated User Sign-In¶
Let MetaMiner Client users sign in to Power BI with their own Microsoft account, so that they see the workspaces they have access to and can run management actions under their own rights.
How it works¶
Delegated sign-in is optional and separate from the service principal. When it is on, each person who loads a Power BI environment in the MetaMiner Client signs in to Microsoft in their browser. From then on:
- The Power BI Explorer shows only the workspaces that person can access in Power BI. MetaMiner users with the Tenant Admin permission can switch to the Tenant Admin View to see every workspace.
- Management actions run as that person, with the delegated permissions Microsoft grants them. The service principal is never used for these actions.
| Property | Value |
|---|---|
| Sign-in flow | OAuth 2.0 authorization code with PKCE, in the system browser |
| Application | The MetaMiner Client application published by Infolytik, client ID b9b45b30-ea3f-4697-8b0c-c7aab438f3e6 |
| Redirect | http://localhost on the user's workstation |
| MFA and Conditional Access | Apply as for any Microsoft sign-in |
| Password | Never entered into or stored by MetaMiner |
| Token on the workstation | Cached per Windows user, encrypted with Windows DPAPI, so later sign-ins are silent until the token expires or is revoked |
| Token on the server | Kept in memory for the user's session only, to run the actions that user starts |
| Clouds | Commercial only. On US Government clouds MetaMiner reports interactive sign-in as unavailable. |
What it enables¶
| Feature | Needs delegated sign-in | Delegated permission requested |
|---|---|---|
| Workspace list filtered to the user | Yes | Power BI Workspace.Read.All |
| Manage Access: list who has access | Yes | Power BI Workspace.Read.All |
| Manage Access: add, change, remove access; grant backup access to the service principal | Yes | Power BI Workspace.ReadWrite.All |
| Restore from a backup archive | Yes | Power BI Workspace.ReadWrite.All; as the selection requires, Dataflow.ReadWrite.All, Content.Create, Dataset.ReadWrite.All, Capacity.Read.All |
| Tenant Admin View actions; restore a deleted workspace | Yes, and the user must hold the Fabric Administrator role | Power BI Tenant.ReadWrite.All |
| Export Meta Query results to a Fabric lakehouse | Yes | Fabric Catalog.Read.All, Item.ReadWrite.All; Azure Storage user_impersonation |
Each action asks only for the permission it needs, when it runs. Signing in and browsing request only Workspace.Read.All. Sign-in also requests the standard openid, profile and offline_access scopes. No Microsoft Graph scope is requested.
Tenant.ReadWrite.All is the broadest permission
It is used only for the Tenant Admin View actions and for restoring deleted workspaces, and Microsoft also requires the Fabric Administrator role for those calls. If your policy withholds it, those features are unavailable and everything else works.
Before you begin¶
- An Entra administrator who can grant tenant-wide admin consent.
- The MetaMiner Administrator on the server host.
TODO: confirm which Entra roles can grant this admin consent
Source to check: Microsoft Learn, "Grant tenant-wide admin consent to an application". Typically Global Administrator or Privileged Role Administrator; Cloud Application Administrator may suffice for non-Graph APIs.
Steps¶
-
Grant admin consent once for the tenant. The delegated permissions above are admin-consent permissions; without consent, non-admin users see a "Need admin approval" prompt. An Entra administrator opens this link, signs in and approves:
https://login.microsoftonline.com/organizations/adminconsent?client_id=b9b45b30-ea3f-4697-8b0c-c7aab438f3e6&redirect_uri=http://localhostAfter approval the browser may show a "can't reach this page" error for
localhost. That is expected; the consent is recorded. Approval creates an enterprise application in your tenant that your administrators can review or remove at any time. -
Turn on Power BI SSO. In the MetaMiner Administrator, select Security > Enable Power BI SSO, then restart the MetaMiner Server.
- Sign in from the client. Each user connects with the MetaMiner Client and loads the Power BI environment. The Power BI sign-in dialog opens; the user clicks Sign in with Microsoft and completes the sign-in in the browser.
Image of the MetaMiner Administrator Security menu with Enable Power BI SSO checked
../images/microsoft-setup/mma-enable-pbi-sso.png
Image of the Power BI sign-in dialog in the MetaMiner Client with the Sign in with Microsoft button
../images/microsoft-setup/mmc-pbi-signin-dialog.png
Password sign-in instead of the browser
Browser sign-in is on by default (server property pbi.interactive.login.enabled=true). If you set it to false in server\MetaMinerServer.properties, users with Power BI SSO are asked for their Microsoft user name and password in a MetaMiner dialog instead. Microsoft does not allow this password flow for accounts that require MFA, and the export to a Fabric lakehouse is unavailable. Use browser sign-in.
Verify¶
- After signing in, the Power BI Explorer shows the user's workspaces.
- Manage Access is available on a workspace. Without Power BI SSO it reports that Power BI SSO is required.
- In Microsoft Entra ID, the MetaMiner Client enterprise application shows the consented permissions.
Troubleshooting¶
Users see Need admin approval
Admin consent has not been granted, or was granted before a permission was added. Have an administrator open the consent link again.
An action fails with a rights message
Microsoft refused the call for the signed-in user: a missing role (for example Fabric Administrator for the Tenant Admin View) or a permission withheld at consent. MetaMiner shows Microsoft's answer; it cannot bypass it.
Interactive sign-in is unavailable
The environment uses a US Government Endpoint Set. Delegated browser sign-in is supported on the Commercial cloud only in this release.