Tenant Settings¶
The Fabric admin portal tenant settings that unlock the Power BI and Fabric APIs for MetaMiner's service principal, and which Test Connection step proves each one.
How it works¶
A service principal's Power BI token carries no Power BI permissions of its own. What it may call is decided by tenant settings in the Fabric admin portal. Enable each setting below for the security group from Security Group for the App, not for the entire organization.
Before you begin¶
- A Fabric administrator account (Fabric Administrator role in Entra, or Global Administrator).
- The security group that contains MetaMiner's service principal.
Required settings¶
| Tenant setting | Admin portal section | Unlocks in MetaMiner | Test Connection step |
|---|---|---|---|
| Service principals can access read-only admin APIs | Admin API settings | Most of the collection: workspaces, modified workspaces, workspace scans, activity events, refreshables, apps, capacities, Fabric item inventory | Service principals can access read-only admin APIs; PBI API/Workspaces |
| Enhance admin API responses with detailed metadata | Admin API settings | Lineage, data source details and semantic model schema (tables, columns, measures) in workspace scans | PBI Workspaces Scan API |
| Enhance admin API responses with DAX and mashup expressions | Admin API settings | DAX and Power Query (M) expressions of semantic models and dataflows in workspace scans | PBI Workspaces Scan API |
| Service principals can use Fabric APIs | Developer settings | Gateways, connections, Fabric item definitions, backup | Fabric API |
Fabric API access is a separate gate
If "Service principals can use Fabric APIs" is off for the group, gateway and connection reads fail with 401 Unauthorized while the rest of the collection looks healthy. Test Connection calls the Fabric gateways API specifically to catch this.
Settings for specific features¶
| Tenant setting | Admin portal section | Needed for |
|---|---|---|
| Allow service principals to use Power BI APIs | Developer settings | Power BI REST calls outside the admin APIs: Capacity Metrics queries, dataflow definitions, .pbix export |
| Semantic model Execute Queries REST API (formerly Dataset Execute Queries REST API) | Integration settings | Capacity Metrics. See Capacity Metrics App. |
TODO: re-check every setting name and admin portal section against current Microsoft Learn
Microsoft has renamed and split these settings over time. The names above follow MetaMiner's Test Connection and the current setup guide. Confirm in particular: (1) the current name of "Service principals can access read-only admin APIs" (older name "Allow service principals to use read-only admin APIs"); (2) whether "Allow service principals to use Power BI APIs" and "Service principals can use Fabric APIs" are one setting or two in current tenants; (3) the current name of the Execute Queries setting. Source: Microsoft Learn, "Developer tenant settings", "Admin API tenant settings" and "Integration tenant settings".
Steps¶
- Sign in to the Fabric portal as a Fabric administrator and open Settings > Admin portal > Tenant settings.
- Find the first setting in the table, for example by typing its name into the search box.
- Switch it to Enabled.
- Under Apply to, select Specific security groups and add your MetaMiner group.
- Click Apply.
- Repeat for every required setting and for the feature settings you need.
Image of the tenant setting Service principals can access read-only admin APIs, enabled and applied to the MetaMiner security group
../images/microsoft-setup/fabric-tenant-setting-readonly-admin-apis.png
Image of the tenant setting Service principals can use Fabric APIs, enabled and applied to the MetaMiner security group
../images/microsoft-setup/fabric-tenant-setting-fabric-apis.png
Changes are not instant
Microsoft applies tenant setting changes after a delay. If Test Connection fails right after you change a setting, wait and run it again.
What MetaMiner does not need¶
- No setting that lets service principals create workspaces or change tenant content is needed for collection.
- No Power BI or Fabric API permissions on the app registration. See API Permissions.
- No workspace membership for the inventory. The admin APIs cover every workspace. See Workspace Access for the features that do need membership.
Verify¶
Run Test Connection for the Power BI environment in the MetaMiner Administrator. These steps must pass:
| Step | Proves |
|---|---|
| Service principals can access read-only admin APIs | The read-only admin API setting is on for the group |
| Fabric API | The Fabric API setting is on for the group |
| PBI API/Workspaces | The admin workspace list works |
| PBI Workspaces Scan API | A full workspace scan with lineage, data source details, schema and expressions runs to completion |
Troubleshooting¶
Service principals can access read-only admin APIs fails
The setting is off, applied to a different group, or the service principal is not in the group. Fix it and wait before testing again.
PBI Workspaces Scan API fails
Enable both "Enhance admin API responses" settings for the group, wait for Microsoft to apply them, and test again. The MetaMiner Administrator log (admin.log) has the Microsoft error for the failed scan call.
Fabric API fails
Enable "Service principals can use Fabric APIs" for the group.