Power BI
This guide walks through the steps required to configure a Service Principal for Solid's Power BI integration, grant the necessary permissions, and validate the setup.
Overview
Solid connects to Power BI using a Microsoft Entra ID (Azure AD) Service Principal and the Power BI Admin APIs to scan tenant metadata such as workspaces, datasets, tables, columns, and measures.
Solid needs:
- A dedicated Service Principal (App Registration) with a Client Secret
- Read-only access to the Power BI Admin APIs, enabled via tenant settings
- Member or Admin access to each workspace Solid should scan
- Network access to
login.microsoftonline.comandapi.powerbi.comover HTTPS (port 443)
What Is Collected
| Category | What | Why |
|---|---|---|
| Admin API Access | Read-only calls to the Power BI Admin Scanner API, enabled by the tenant setting "Service principals can access read-only admin APIs" | Allows the Service Principal (SP) to call the Admin Scanner API |
| Detailed Metadata | Table, column, and measure names and descriptions, returned when "Enhance admin APIs responses with detailed metadata" is enabled | Returns table/column/measure names and descriptions |
| DAX and Mashup Expressions | DAX formulas and M (Power Query) source expressions, returned when "Enhance admin APIs responses with DAX and mashup expressions" is enabled | Returns DAX formulas and M (Power Query) source expressions |
| Workspace Scope | Only workspaces where the Service Principal (or its security group) has been added as Member or Admin | Limits scanning to workspaces you've explicitly granted access to |
Automatic Pull (Recommended)
Step 1: Create a Service Principal Account for Solid
Access required: Azure AD / Microsoft Entra ID app registration
App Registration
- In the Azure portal, navigate to Microsoft Entra ID > App Registrations > New Registration.
- You can sign in using existing Microsoft 365 / Power BI credentials — no Azure subscription is required.
- After creation, note the following from the Overview page:
- Application (Client) ID
- Directory (Tenant) ID
Step 2: Assign Permissions and Grant Workspace Access
Solid needs to "see" your content to index it properly.
Security Group
- In Entra ID > Groups > New Group, create a group of type Security.
- Add the app registration as a member of this group.
- This group is referenced in the Power BI tenant settings below.
Required Permissions to Complete This Setup
| Requirement | Details |
|---|---|
| Power BI Admin | Required to modify tenant settings in the Admin Portal (Fabric/Power BI Admin role) |
| Azure portal access | via Microsoft 365 / Entra credentials — no Azure subscription needed |
| App Registration creation | Requires one of: Application Administrator, Cloud Application Administrator, or Global Administrator |
| Security Group creation | Required only if enabling access for a subset of the organization (optional if enabling org-wide) |
API Permissions — None Required
Critical: The app registration must NOT have any API permissions configured in the Azure portal (noTenant.Read.All, no delegated permissions). Adding permissions breaks admin API access.
Power BI Tenant Settings
Requires a Power BI Admin
In the Power BI Admin Portal > Tenant Settings, enable the following settings, applied to the security group created above:
| Setting | Location | Why |
|---|---|---|
| Service principals can access read-only admin APIs | Admin API settings | Allows the SP to call the Admin Scanner API |
| Enhance admin APIs responses with detailed metadata | Admin API settings | Returns table/column/measure names and descriptions |
| Enhance admin APIs responses with DAX and mashup expressions | Admin API settings | Returns DAX formulas and M (Power Query) source expressions |
Reference: Microsoft - Metadata scanning setup
Note: Changes to tenant settings can take up to 15 minutes to propagate. After enabling detailed metadata, datasets may need a refresh before the metadata appears in scan results.
Workspace-Level Access
The Service Principal (or its security group) must be added as a Member or Admin to each Power BI workspace that Solid needs to scan.
In Power BI Service > Workspace > Access, add the app name or security group as Member.
Network / IP Considerations
Our integration connects to two Microsoft public endpoints over HTTPS (port 443):
login.microsoftonline.com(authentication)api.powerbi.com(metadata scanning)
If your organization has Conditional Access policies, IP-based restrictions, or Azure Private Link enabled for Power BI, access from our IPs may be blocked. Our outbound IPs are listed here: http://docs.getsolid.ai/docs/solids-static-ip-addresses
Step 3: Generate API Credentials
Client Secret
- In the app registration, go to Certificates & Secrets > New client secret.
- Copy the secret value immediately — it is shown only once.
- Set the expiry to 12–24 months.
Step 4: Deliver Credentials to Solid
Workspace GUID
Provide at least one Workspace GUID for initial validation. This can be found in the Power BI URL:
https://app.powerbi.com/groups/{WORKSPACE_GUID}/...Output to Share with Solid
| Field | Description |
|---|---|
CLIENT_ID | Application/Client ID (GUID) |
CLIENT_SECRET | The client secret value |
ENTRA_TENANT_ID | Directory/Tenant ID (GUID) |
Permissions Needed
| Permission/Role | Purpose |
|---|---|
| Power BI Admin (Fabric/Power BI Admin role) | Required to modify tenant settings in the Power BI Admin Portal |
| Application Administrator / Cloud Application Administrator / Global Administrator (Entra ID) | Required to create the App Registration (one of these three roles) |
| Security Group creation rights (Entra ID) | Required only if restricting access to a subset of the org (optional if enabling org-wide) |
| Service principals can access read-only admin APIs (tenant setting) | Allows the Service Principal to call the Admin Scanner API |
| Enhance admin APIs responses with detailed metadata (tenant setting) | Returns table/column/measure names and descriptions |
| Enhance admin APIs responses with DAX and mashup expressions (tenant setting) | Returns DAX formulas and M (Power Query) source expressions |
| Workspace Member or Admin (per workspace) | Grants the Service Principal (or its security group) access to scan that workspace |
| Azure AD API Permissions | None required — must NOT be configured; adding permissions (e.g. Tenant.Read.All, delegated permissions) breaks admin API access |
Troubleshooting
Network / Conditional Access Issues
If your organization has Conditional Access policies, IP-based restrictions, or Azure Private Link enabled for Power BI, access from Solid's IPs may be blocked.
To check if any of these apply to you:
- Azure portal > Microsoft Entra ID > Security > Conditional Access — look for policies that restrict sign-ins by IP or location
- Azure portal > Microsoft Entra ID > Security > Named Locations — check for trusted location requirements
- Power BI Admin Portal > Tenant Settings > Advanced Networking — if "Block Public Internet Access" is enabled, public API access will not work and it must be disabled
If any of these restrictions are in place, please whitelist Solid's outbound IPs (listed at http://docs.getsolid.ai/docs/solids-static-ip-addresses).
Security Notes
- Use a dedicated Service Principal rather than a personal account for Solid's access
- Store the Client Secret securely immediately after creation — it is shown only once
- Set Client Secret expiry to 12–24 months and rotate it before it lapses
- Do not configure any API permissions on the app registration beyond what's required — adding permissions (e.g.
Tenant.Read.All, delegated permissions) breaks admin API access - Scope access with a dedicated Security Group rather than granting org-wide access, if you want to limit which workspaces Solid can reach
- Grant the Service Principal only Member/Admin access to the specific workspaces Solid needs to scan
Updated 8 days ago