Skip to content

Network Exposure

Which ports on the MetaMiner Server host must be reachable from where, which services stay local, which Microsoft endpoints MetaMiner calls, and how to set firewall rules.

How it works

Users reach MetaMiner through one port: the MetaMiner Server (MMS) port, 49714 by default. The MetaMiner Client (MMC), the Power BI usage dashboards and Meta Query on the web all use it. The other MetaMiner services on the host are internal and serve the MMS.

The MMS calls Microsoft over outbound HTTPS. Microsoft never connects in to MetaMiner.

flowchart LR
  subgraph Users
    MMC[MetaMiner Client]
    BR[Browser]
  end
  MMC -->|49714| MMS
  BR -->|49714| MMS
  subgraph Host[MetaMiner Server host]
    MMS[MetaMiner Server]
    WA[Web Apps 49717 local]
    DB[(Embedded MMDB 49614)]
  end
  MMS --> WA
  MMS --> DB
  RT[Approved reporting hosts] -->|49614| DB
  MMS -->|443 outbound| MS[Microsoft endpoints]
  MMC -->|443 outbound| MSU[Microsoft sign-in]

Inbound to the MetaMiner Server host

Port Service Allow from Notes
TCP 49714 MetaMiner Server (metaminer) MMC users' networks; administrators' browsers The only port users need. Change it in Preferences > Settings... > General > Server Port. Turn on SSL
UDP 49352, 54215, 58632, 63759 MetaMiner Server discovery (multicast group 228.5.6.7) MMC users on the same LAN, optional Lets the MMC find servers automatically. Without it, users type the server name
TCP 49614 Embedded MetaMiner Database (InfolytikPostgres) Only hosts you approve for direct database access Not needed by MMC users. Restrict also in pg_hba.conf (MetaMiner Database SSL)
TCP 49717 Web Apps (MetaMinerWebApps) Nobody Answers local requests only. Browsers reach the web apps through port 49714

Services that stay local

These serve only programs on the server itself. Do not open them in the firewall.

Service Port Purpose
Web Apps 49717 Back end of the usage dashboards and Meta Query on the web, reached through the MMS
Database Console dynamic Browser-based MMDB console started from the MetaMiner Administrator, bound to 127.0.0.1

The installer reserves ports 49714, 49614, 49716 and 49717 so Windows does not assign them to other programs. If you change the MMS port, reserve the new port; see MetaMiner Server SSL.

Outbound from the MetaMiner Server host

Destination (commercial cloud) Port Purpose
login.microsoftonline.com 443 Tokens for the service principal
api.powerbi.com 443 Power BI REST: inventory, activity, scans, report export, workspace access, restore
api.fabric.microsoft.com 443 Fabric REST: items, gateways, connections, definitions, backup and restore
graph.microsoft.com 443 Microsoft Graph, only if you granted Graph permissions
External MMDB 5432 typical When the MMDB is not embedded
LDAP or Active Directory 389 or 636 Directory sign-in
Mail server Your SMTP port Notifications

Sovereign clouds use different host names. See Sovereign Clouds and Network and Microsoft Endpoints.

Outbound from MMC workstations

Destination Port Purpose
MetaMiner Server 49714 All MetaMiner traffic
login.microsoftonline.com 443 Microsoft interactive sign-in, when Power BI SSO is on
api.fabric.microsoft.com, onelake.dfs.fabric.microsoft.com 443 Export to Fabric Lakehouse, if used
app.powerbi.com 443 Open in Default Browser

The interactive sign-in completes on a http://localhost address on the workstation itself. No inbound port is opened on the network. US Government clouds use the matching government host names.

Steps: set firewall rules

  1. On the MetaMiner Server host, open Windows Defender Firewall with Advanced Security.

  2. Create an inbound rule for TCP 49714 limited to your user subnets:

    Allow the MetaMiner Server port from approved subnets
    New-NetFirewallRule -DisplayName "MetaMiner Server 49714" -Direction Inbound -Protocol TCP `
  -LocalPort 49714 -RemoteAddress 10.20.0.0/16,10.30.5.0/24 -Action Allow

  3. If reporting hosts read the MMDB, create a rule for TCP 49614 limited to those hosts.

  4. Do not create a rule for 49717.
  5. On your outbound firewall or proxy, allow the MetaMiner Server host to reach the Microsoft endpoints above on 443.
  6. Repeat the port 49714 rule on network firewalls between users and the server.

Verify

  1. From a user workstation: powershell Test-NetConnection <server> -Port 49714 returns TcpTestSucceeded : True.
  2. From the same workstation: Test-NetConnection <server> -Port 49717 and -Port 49614 return False (unless that workstation is an approved reporting host).
  3. On the MetaMiner Server host: Test-NetConnection api.powerbi.com -Port 443 returns True.
  4. In the MetaMiner Administrator, Test Connection on the environment passes.

Next steps