Tenant Admin View¶
The Tenant Admin View toggle in the Power BI Explorer lets a tenant administrator see every workspace in the tenant, not only the workspaces their own Microsoft account can access, and switches workspace actions to the Power BI admin APIs.
How it works¶
With Power BI SSO on, the MetaMiner Server (MMS) filters the Power BI Explorer to the workspaces the signed-in user's Microsoft account can access. The Tenant Admin View removes that filter for users who hold the Tenant Admin permission. The MMS checks the permission again on every request; the toggle alone grants nothing.
| Normal view | Tenant Admin View | |
|---|---|---|
| Workspaces shown | Workspaces the user's Microsoft account can access | Every workspace MetaMiner collected, including personal workspaces |
| Workspaces deleted in Power BI | Hidden | Shown in red |
| Manage Access... | Runs the Power BI workspace APIs as the user. Changes work where the user is a workspace Admin | Runs the Power BI admin APIs as the user. Needs the Fabric Administrator role |
| Restore workspace | Not available | Available on a deleted workspace |
| Toolbar | Tenant Admin View button | Tenant Admin View button pressed, label Admin View |
Image of the Power BI Explorer toolbar with the Tenant Admin View button pressed, the Admin View label, and a deleted workspace shown in red in the tree
../images/security/mmc-tenant-admin-view.png
When the toggle is visible¶
The Tenant Admin View button appears at the end of the Power BI Explorer toolbar when both are true:
| Condition | How to meet it |
|---|---|
| The user connected with Power BI SSO | Enable Power BI SSO is on in the MetaMiner Administrator, and the user signed in to Microsoft. See User-Based Security |
| The user holds Tenant Admin in at least one loaded Power BI environment | Assign a role that includes Tenant Admin. See Users and Roles. When MetaMiner Security is off, every user holds every permission |
Without Power BI SSO the button is hidden. In that case every user already sees every workspace, and Manage Access and workspace restore are unavailable.
Microsoft requirements for admin actions¶
Viewing all workspaces needs only the MetaMiner permission. Admin actions run as the signed-in user and also need:
| Action | Microsoft role | Delegated permission |
|---|---|---|
| List, add, update or remove workspace access in the admin view | Fabric Administrator | Tenant.ReadWrite.All (Power BI) |
| Restore a deleted workspace | Fabric Administrator | Tenant.ReadWrite.All (Power BI) |
If the signed-in account is not a Fabric Administrator, Microsoft refuses the call and the Manage Access dialog shows No Access for the workspace. See Tenant Security Posture.
Steps¶
Turn the view on¶
- Connect with Power BI SSO and open the Power BI Explorer tab.
- Click Tenant Admin View on the toolbar. The client reloads every Power BI environment and shows Loading all workspaces....
- When loading finishes, the label Admin View appears and the tree shows every workspace.
Turn the view off¶
- Click Tenant Admin View again. The client reloads the environments with your own workspace filter.
The view stays on for reloads with F5 until you turn it off. If the reload fails, the button returns to its previous state.
Verify¶
- With the view on, the tree shows workspaces you are not a member of.
- With the view off, the same workspaces are hidden.
Troubleshooting¶
The Tenant Admin View button is missing
Power BI SSO is off, you did not sign in to Microsoft, or none of the loaded Power BI environments grants you Tenant Admin.
Manage Access shows No Access in the admin view
The Power BI admin API refused your signed-in account. It is most likely not a Fabric Administrator, or your organization has not consented to Tenant.ReadWrite.All for the MetaMiner sign-in app. See Delegated User Sign-In.