Skip to content

Security Group for the App

Create a Microsoft Entra security group that contains MetaMiner's service principal, so you can enable the Fabric tenant settings for MetaMiner alone instead of for every application in the tenant.

How it works

Fabric tenant settings for service principals can apply to the entire organization or to specific security groups. MetaMiner needs several of these settings. Scoping each one to a dedicated group means:

  • Only MetaMiner's application gets the access, not every service principal in the tenant.
  • You can stop MetaMiner's access at once by removing the service principal from the group.
  • Security reviewers see one group that documents what MetaMiner may do.

The same group can also be given a workspace role where MetaMiner needs one, for example on the Capacity Metrics workspace. See Workspace Access.

Before you begin

  • The app registration from Register the Application.
  • An Entra account that can create groups and manage their members, for example the Groups Administrator role.

Steps

  1. In the Microsoft Entra admin center, go to Entra ID > Groups and click New group.

    TODO: re-check the Entra admin center Groups path and labels against current Microsoft Learn

    Source to check: Microsoft Learn, "Manage Microsoft Entra groups and group membership".

  2. Set Group type to Security.

  3. Enter a name, for example MetaMiner-ReadOnly, and a description that says what the group is for.
  4. Under Members, add the MetaMiner application. Search by the application name; it is listed as an enterprise application (service principal).
  5. Click Create.

Image of the new security group's Members page showing the MetaMiner enterprise application as the only member

../images/microsoft-setup/entra-security-group-members.png

Keep the group for MetaMiner only

Do not add people or other applications. Anything in this group receives the tenant-wide read access the settings grant.

Verify

  • The group's Members page lists the MetaMiner application.
  • The group type is Security (Fabric tenant settings accept security groups).

Troubleshooting

Test Connection fails at Service principals can access read-only admin APIs

The group is not selected in that tenant setting, the application is not a member, or Microsoft has not yet applied the change. Tenant setting changes can take some time to take effect. See Tenant Settings.

The application cannot be found when adding members

Search for the application's display name or its Application (client) ID. If it still does not appear, check that its enterprise application exists under Enterprise applications.

Next steps