Tenant Security Posture¶
What MetaMiner does in your Microsoft tenant: it reads metadata with an identity you own, writes only when a signed-in user starts an action, and stores no Microsoft tokens on disk on the server.
How it works¶
MetaMiner uses two Microsoft identities. Microsoft Entra ID authorizes every call, under either identity, against the permissions your administrators granted.
flowchart LR
subgraph Server[MetaMiner Server host]
MMS[MetaMiner Server]
end
subgraph WS[User workstation]
MMC[MetaMiner Client]
end
MMS -->|service principal, client secret| API[Power BI, Fabric and Graph APIs]
MMC -->|user signs in with Microsoft| ENTRA[Microsoft Entra ID]
MMC -->|user token for one action| MMS
MMS -->|as the signed-in user| API| Identity | Authenticates with | Used for | Writes? |
|---|---|---|---|
| Service principal | Client credentials (tenant ID, client ID, client secret) configured in the MetaMiner Administrator (MMA) | Scheduled metadata pull, connection validation, .pbix export, backup jobs |
No changes to content or settings. Backup jobs only read |
| Signed-in user | Microsoft interactive sign-in from the MetaMiner Client (MMC) | Actions a user starts: workspace access changes, workspace restore, restore from backup, lakehouse export | Yes, as that user, only when the user starts the action |
The service principal cannot act as a user, and a signed-in user cannot borrow the service principal's rights.
Read-only inventory by default¶
The scheduled pull reads your tenant with the service principal. It changes nothing in Power BI, Fabric or Microsoft Entra ID.
| Area | What is read | Microsoft requirement |
|---|---|---|
| Workspaces and content | Workspaces, reports, dashboards, semantic models, dataflows, apps, Fabric items, lineage, data sources, users with access | Read-only admin API tenant settings enabled for the app's security group |
| Change detection | Workspaces modified since the last pull | Same |
| Activity | Power BI activity events | Same |
| Capacities and refreshes | Capacities, refreshable items, refresh history | Same |
| Gateways and connections | Fabric gateways and connections | Service principals can use Fabric APIs |
| Item definitions | Report, semantic model and dataflow definitions | The service principal, or a group it belongs to, has the Admin, Member or Contributor role in the workspace |
| Capacity metrics | Results of read-only DAX queries against the Fabric Capacity Metrics semantic model, when you configure one | Access to the Capacity Metrics workspace |
| Microsoft Graph (optional) | Users, groups, group members, service principals, applications, licence SKUs and assignments | Graph application permissions you grant |
Some reads use HTTP POST because the Microsoft API is designed that way, for example the workspace scan request and item definition requests. These calls submit a read request; they do not change content.
MetaMiner reads metadata, not the data in your semantic models. Definitions and expressions can name source servers and databases, so treat the MetaMiner Database (MMDB) as sensitive. See What MetaMiner Stores.
The exact tenant settings and API permissions are in Microsoft Permissions Overview, API Permissions and Tenant Settings.
Features that write¶
Every write is started by a person in the MMC. None runs in the background pull.
| Feature | Identity | Microsoft permission requested | Microsoft role needed | MetaMiner requirement |
|---|---|---|---|---|
| Manage Workspace Access: list access | Signed-in user | Workspace.Read.All (Power BI) |
Access to the workspace | Power BI SSO on |
| Manage Workspace Access: add, update, remove | Signed-in user | Workspace.ReadWrite.All (Power BI) |
Workspace Admin | Power BI SSO on |
| Manage Workspace Access in the Tenant Admin View | Signed-in user | Tenant.ReadWrite.All (Power BI) |
Fabric Administrator | Tenant Admin |
| Restore a deleted workspace | Signed-in user | Tenant.ReadWrite.All (Power BI) |
Fabric Administrator | Tenant Admin, Tenant Admin View |
| Grant backup access | Signed-in user | Workspace.ReadWrite.All (Power BI) |
Workspace Admin, or Fabric Administrator | Tenant Admin |
| Restore from a backup | Signed-in user | Workspace.ReadWrite.All; as needed Dataflow.ReadWrite.All, Content.Create, Dataset.ReadWrite.All, Capacity.Read.All (Power BI) |
Rights to create content in the target workspace | Tenant Admin |
| Export to Fabric Lakehouse | Signed-in user, from the workstation | Catalog.Read.All, Item.ReadWrite.All (Fabric); user_impersonation (Azure Storage) |
Write access to the lakehouse | Microsoft interactive sign-in |
Grant backup access adds the MetaMiner service principal to the selected workspaces with the Contributor role, so backup jobs can read item definitions. It adds access only; it never removes any. MetaMiner records each grant with the MetaMiner user who made it.
A backup job runs as the service principal. It reads definitions and exports report files into an archive on the MetaMiner Server host. See How Backup Works.
Withholding a permission disables only its feature
If your administrators do not consent to a delegated permission, only the feature that needs it is unavailable. For example, withholding Tenant.ReadWrite.All disables workspace restore and admin-view access changes; the inventory and every other feature keep working.
The interactive sign-in app¶
Microsoft interactive sign-in uses a public client app published by Infolytik, client ID b9b45b30-ea3f-4697-8b0c-c7aab438f3e6. It uses the authorization code flow with PKCE and a http://localhost redirect, so the sign-in completes on the user's own workstation. MetaMiner never receives the user's password.
Most of the delegated permissions above require admin consent in Microsoft Entra ID. Consenting once for the organization creates an Enterprise Application in your tenant that you can review or remove at any time. See Delegated User Sign-In.
At sign-in the MMC requests only Workspace.Read.All plus the standard OpenID scopes. It requests the other permissions when a user starts the action that needs them.
Sovereign clouds
Microsoft interactive sign-in is available for the commercial cloud. See Sovereign Clouds.
Where tokens and secrets live¶
| Item | Location | Lifetime |
|---|---|---|
| Client secret of the service principal | server\config\config.json on the MetaMiner Server host, stored encrypted |
Until you replace it. Set the expiry your policy requires and update it in MMA before it expires |
| Service principal access tokens | Memory of the MetaMiner Server | Renewed before expiry; never written to disk |
| User sign-in token cache | %APPDATA%\MetaMiner\auth\pbi-token-cache.bin on the user's workstation, protected with Windows DPAPI for that Windows user |
Until the user signs out, or the refresh token is revoked or expires |
| User access token sent for an action | Memory of the MetaMiner Server, for the user's session | Never written to disk |
No tenant metadata or token is sent to Infolytik. See Secrets and Configuration Encryption.
Principle of least privilege¶
- Create a dedicated app registration for MetaMiner and a security group that contains only its service principal. Enable the Fabric tenant settings for that group, not for the whole organization. See Security Group for the App.
- Grant Microsoft Graph permissions only if you want the Entra Users and Groups and Licenses views. Use the granular read permissions instead of the broader directory permission. See API Permissions.
- Add the service principal to individual workspaces only where you need item definitions or backups.
- Consent only to the delegated permissions of the features you use.
- Turn on Power BI SSO so each MMC user sees only their own workspaces, and give Tenant Admin only to Fabric administrators. See Tenant Admin View.
- Grant MetaMiner write features through roles, per environment. See Users and Roles.
- Review the app's Enterprise Application, its consented permissions and the service principal's workspace roles periodically.