Skip to content

Security Model

MetaMiner protects access and data in layers: the network, TLS on each connection, two separate Microsoft identities, MetaMiner users and roles, Power BI sign-in per user, database roles and secrets at rest.

How it works

The MetaMiner Server (MMS) runs on your infrastructure. It reads your Microsoft tenant with an app registration you own and stores the metadata in the MetaMiner Database (MMDB). Users reach MetaMiner through one MMS port, 49714 by default, with the MetaMiner Client (MMC) or a browser.

flowchart LR
  MMC[MetaMiner Client] -->|49714 TLS optional| MMS[MetaMiner Server]
  Browser[Web browser] -->|49714 /web| MMS
  MMS -->|local only| WA[Web Apps service]
  MMS -->|JDBC, SSL optional| MMDB[(MetaMiner Database)]
  MMS -->|HTTPS 443, app identity| MS[Microsoft Entra ID, Power BI, Fabric, Graph]
  MMC -->|HTTPS 443, user sign-in| ENTRA[Microsoft Entra ID]
  MMA[MetaMiner Administrator] -->|on the server host| MMS

Each layer is described below with the page that configures it.

Layers

Network

Only the MMS port needs to be reachable from user workstations. The Web Apps service answers local requests only. The MMS needs outbound HTTPS to Microsoft and nothing inbound from Microsoft.

See Network Exposure.

Transport (TLS)

Hop How it is encrypted
MMC and browsers to MMS TLS on the MMS port (MetaMiner Server SSL)
MMS to Microsoft APIs HTTPS with TLS 1.2 or 1.3, always on (Trusted Certificates)
MMS to MMDB PostgreSQL SSL (MetaMiner Database SSL)
MMS to LDAP or Active Directory LDAPS (Import Users from LDAP or AD)

The full map is in SSL Overview.

Two Microsoft identities

MetaMiner acts in your tenant under one of two identities, and they never mix.

Identity What it is What it does
Service principal (app-only) The app registration you create, with a client secret, configured per environment in the MetaMiner Administrator (MMA) The scheduled, read-only metadata pull. Also runs backup jobs if you use them
Signed-in user (delegated) A MetaMiner Client user signed in with their own Microsoft account User-initiated actions such as Manage Access, restoring a deleted workspace, restoring from a backup, and export to a Fabric lakehouse

Microsoft Entra ID authorizes every call under either identity. A MetaMiner permission lets a user try an action; Microsoft still decides whether the account may perform it.

See Tenant Security Posture and Service Accounts.

MetaMiner users, roles and permissions

When MetaMiner Security is on, every MMC connection needs a MetaMiner user name and password. Each user has one role per environment. A role is a set of permissions, and each permission shows a tab or allows an action. The MMS checks permissions on the server for every protected request.

Three system roles exist: No Access, Read Only and Administrator. You can add your own roles.

See User-Based Security, Users and Roles and Permissions Reference.

Power BI sign-in per user

With Enable Power BI SSO on, each MMC user signs in to Microsoft when connecting. The Power BI Explorer then shows only the workspaces that user's Microsoft account can access. Users who hold Tenant Admin can switch to the Tenant Admin View to see every workspace.

Without Power BI SSO, every MMC user who can open the environment sees every workspace that MetaMiner collected.

Meta Query is not filtered by workspace

Meta Query reads the MetaMiner Database directly and shows tenant-wide metadata. Grant Tab: Meta Query only to users who may see the whole tenant.

Directory authentication

Users imported from LDAP or Active Directory sign in to MetaMiner with their directory password. The directory enforces password rules and account status for those users.

See Import Users from LDAP or AD.

MetaMiner Database roles

Role Used by Access
Configured MMDB account MetaMiner Server Owns the MetaMiner schemas, reads and writes
readonly Read-only features and your reporting logins Read only
mq_reader, mq_reader_all Meta Query on the web Read only, with a connection limit and statement timeout

See Service Accounts.

Secrets at rest

Secret Where it is kept Protection
Service principal client secret server\config\config.json Stored encrypted. Optionally encrypt the whole file
MMDB, LDAP, SMTP and SSL key passwords server\config\config.json Stored encrypted
MetaMiner user accounts server\security\ Stored encrypted
A user's Microsoft sign-in The user's workstation, %APPDATA%\MetaMiner\auth\ Token cache protected with Windows DPAPI. The MMS keeps the user's token in memory for the session only

See Secrets and Configuration Encryption and What MetaMiner Stores.

Administration

MMA runs on the MMS host and edits the server configuration and the security files directly. Anyone who can run MMA on that host can change security settings. Limit interactive logon to the MMS host to MetaMiner administrators.

Key terms

Term Meaning
MetaMiner Security The setting that makes MMC connections require a MetaMiner user and password
Role A named set of permissions, assigned per user per environment
Service principal The Microsoft Entra app registration MetaMiner pulls with
Power BI SSO The setting that makes each MMC user sign in to Microsoft and limits the explorer to that user's workspaces
Tenant Admin The MetaMiner permission for tenant-wide views and admin actions