Skip to content

Users and Roles

Create MetaMiner users, define roles as sets of permissions, and assign each user one role per environment in the MetaMiner Administrator (MMA).

Before you begin

  • Run MMA on the MetaMiner Server host.
  • Add your Power BI environments first. The user grid has one column per environment. See Add an Environment.
  • For directory users, configure LDAP or Active Directory first. See Import Users from LDAP or AD.

How roles work

  • A role is a named set of permissions. See Permissions Reference.
  • Each user has one role in each environment. The same user can be Administrator in a test tenant and Read Only in production.
  • A user with no role in an environment gets No Access there.
  • Roles apply when MetaMiner Security is on. See User-Based Security.
  • MetaMiner roles do not change anything in Microsoft. With Power BI SSO on, what a user sees and changes is also limited by their own Microsoft account.
System role Permissions relevant to Power BI Can be changed
No Access None No
Read Only MetaMiner Client access, Tab: Alerts, Tab: Meta Query, plus tab permissions for tabs that a Power BI-only installation does not show. No Power BI permissions No
Administrator Every permission, including Tenant Admin No

Read Only includes Meta Query

Read Only shows the Meta Query tab, which reads tenant-wide metadata from the MetaMiner Database. For users who should only browse their own workspaces, create a custom role without Tab: Meta Query.

Suggested roles

Role Permissions For
Power BI Viewer (custom) View Security, View Activities, Open in Default Browser Workspace owners and analysts who browse their own content
Power BI Analyst (custom) Viewer permissions plus Tab: Meta Query Governance analysts who query tenant-wide metadata
Power BI Tenant Admin (custom) Analyst permissions plus Tenant Admin Fabric administrators who use the Tenant Admin View, Entra Users and Groups, backup and restore
Administrator Everything MetaMiner administrators

Create a role

  1. In MMA, click Security > Define Roles....
  2. Click Add. The Add Role dialog opens.
  3. Enter a Name and a Description.
  4. In Permissions, tick the permissions the role grants. Power BI permissions are under PowerBI; permissions that apply to every platform, such as Tab: Meta Query, are under Common. Tick a group to select every permission in it.
  5. Click OK.

Image of the Add Role dialog with the PowerBI permission group expanded and View Security, View Activities and Open in Default Browser ticked

../images/security/mma-add-role.png

To change a role, select it and click View. Custom roles open in Edit Role; system roles open read-only in View Role. Click Delete to remove a custom role. Deleting a role that is in use moves its users to No Access in those environments.

Create a user

  1. Click Security > Define Users.... The grid shows one row per user and one column per environment.
  2. Click Add. The Add User dialog opens.

  3. Fill in the fields:

    Field What to enter
    Name The sign-in name. Names are not case sensitive
    Email Used for notifications and password reset requests
    Password / Confirm password The initial password. Not used for LDAP/Active Directory users
    Force user to change password on next login Recommended for new users
    MMDB Administrator Gives the user the administrator limits in Meta Query on the web
    Disabled Blocks sign-in without deleting the user
    LDAP/Active Directory User The password is checked against the directory

  4. Click OK.

Image of the Add User dialog with Name, Email and Force user to change password on next login filled in

../images/security/mma-add-user.png

To change a user, select the user and click Edit. The Edit User dialog also shows Failed Attempts with a Reset button, Last Logon, Password Changed and Passwords in History.

The MetaMiner user name does not have to match the user's Microsoft account. With Power BI SSO, the Microsoft account the user signs in with decides which workspaces they see.

Assign roles

  1. In Define Users..., select one or more cells. Each cell is a user in an environment.
  2. Click Assign Role.
  3. Select the role and confirm.

Image of the Define User Based Security grid with users as rows, Power BI environments as columns and role names in the cells

../images/security/mma-define-users-grid.png

To force a password change, right-click one or more users and click Force Password Change....

Verify

  1. Connect with the MetaMiner Client as the user.
  2. Check that only the expected tabs appear and that restricted actions are hidden or refused.

Troubleshooting

A tab is missing although the role grants it

Tab permissions under Common must be granted in every environment the user loads in that session. See How permissions apply.

Changes do not show in an open client

Ask the user to reconnect.

Next steps