How to set up Microsoft Power BI

Atlan supports the following authentication methods for fetching metadata from Microsoft Power BI:

• Delegated user authentication
• Service principal authentication

Register app with Microsoft Entra ID

As a prerequisite for using either authentication method, you will need to register a client application with Microsoft Entra ID and note down the values of the tenant ID, client ID, and client secret.

To register your client application with Microsoft Entra ID:

1. Log in to the Azure portal.
2. In the search bar, search for Microsoft Entra ID and select it from the dropdown list.
3. From the left menu of the Microsoft Entra ID page, click App registrations.
4. From the toolbar on the App registrations page, click + New registration.
5. On the Register an application page, for Name, enter a name for your client application and then click Register.
6. On the homepage of your newly created application, from the Overview screen, copy the values for the following fields and store them in a secure location:
   • Application (client) ID
   • Directory (tenant) ID
7. From the left menu of your newly created application page, click Certificates & secrets.
8. On the Certificates & secrets page, under Client secrets, click + New client secret.
9. In the Add a client secret screen, enter the following details:
   1. For Description, enter a description for your client secret.
   2. For Expiry, select when the client secret will expire.
   3. Click Add.
10. On the Certificates & secrets page, under Client secrets, for the newly created client secret, click the clipboard icon to copy the Value and store it in a secure location.

Create a security group in Microsoft Entra ID

To create a security group:

1. Log in to the Azure portal.
2. In the search bar, search for Microsoft Entra ID and select it from the dropdown list.
3. In the left menu, under the Manage section, click Groups.
4. From the top of the page, click the New group button.
5. Set the Group type to Security.
6. Enter a Group name and (optionally) a Group description.
7. Under Members, click the No members selected link.
8. Depending on the authentication method you choose, configure the following:
   • For Delegated User authentication, search for the user and click to select it.
   • For Service Principal authentication, search for the application registration created above and click to select it.
9. At the bottom of the page, click the Select button.
10. At the bottom of the page, click the Create button.

Assign security group and role in Microsoft Power BI workspace

There are three ways to add a security group to a Microsoft Power BI workspace role:

• Manually, outlined below
• Using PowerShell
• Using the Groups - add group user API

To assign a Microsoft Power BI workspace role to the security group:

1. Open the Microsoft Power BI homepage.
2. From the menu on the left, open Workspaces and then the workspace you want to access from Atlan.
3. Above the table, click the Access button.
4. In the resulting panel:
   1. Inside the text box that says Enter email addresses, enter the name of the security group you created above.
   2. Depending on your workspace settings, you can either:
      • For workspaces that do not have any parameters defined, change the dropdown below this to Viewer.
      • If your workspace has any semantic models with parameters defined, change the dropdown below this to Contributor to bring in the parameters to Atlan. You will have to do this for all existing workspaces for which parameters have been defined.
      • To crawl and generate lineage for dataflows, in addition to crawling defined parameters for semantic models, change the dropdown below this to Member.
   3. Below the dropdown, click the Add button.

Delegated user authentication

Assign Fabric administrator role in Microsoft 365

To assign the delegated user to the Fabric Administrator role:

1. Open the Microsoft 365 admin portal.
2. From the left menu of the Microsoft 365 admin center, click Users and then click Active users.
3. On the Active users page, select the delegated user that you want to assign the role to.
4. In the selected user form, under Roles, click Manage roles.
5. In the Manage admin roles form, expand the Show all by category dropdown, and then from under the Collaboration category, select the Fabric Administrator role.
6. Click Save changes to save your selections.

Add permissions in Microsoft Entra ID

To add permissions for the registered application:

1. In the left menu of the app registration, under the Manage section, click API permissions.
2. Under the Configured permissions heading, click the Add a permission button.
3. Using Cmd+F / Ctrl+F search for and click the Power BI Service tile.
4. In the resulting page, click Delegated permissions and select the following necessary permissions to allow Atlan to fetch metadata:
   
   • Capacity.Read.All
   • Dataset.Read.All
   • Report.Read.All
   • Tenant.Read.All
   • Workspace.Read.All
5. At the bottom of the page, click the Grant Admin consent button. (If you only see the Add permissions button you are not an administrator.)

Enable extra admin API settings in Microsoft Power BI

To enable the Microsoft Power BI admin API:

1. Log in to the Power BI admin portal.
2. From the menu under Admin portal click Tenant settings.
3. Under the Admin API settings heading, configure the following:
   1. Click to expand the Enhance admin APIs responses with detailed metadata expandable and ensure this is Enabled.
      1. Under Specific security groups, add the security group created above.
      2. At the bottom of the expanded section, click the Apply button.
   2. Click to expand the Enhance admin APIs responses with DAX and mashup expressions expandable and ensure this is Enabled.
      1. Under Specific security groups, add the security group created above.
      2. At the bottom of the expanded section, click the Apply button.

Service principal authentication

Enable extra admin API settings in Microsoft Power BI

To enable the Microsoft Power BI admin API:

1. Log in to the Power BI admin portal.
2. From the menu under Admin portal click Tenant settings.
3. Under the Developer settings heading, click to expand Service principals can use Fabric APIs and ensure this is Enabled.
   1. Under Specific security groups (Recommended), add the security group created above.
   2. At the bottom of the expanded section, click the Apply button.
4. Under the Admin API settings heading, configure the following:
   1. Click to expand the Allow service principals to use read-only Power BI admin APIs expandable and ensure this is Enabled.
      1. Under Specific security groups, add the security group created above.
      2. At the bottom of the expanded section, click the Apply button.
   2. Click to expand the Enhance admin APIs responses with detailed metadata expandable and ensure this is Enabled.
      1. Under Specific security groups, add the security group created above.
      2. At the bottom of the expanded section, click the Apply button.
   3. Click to expand the Enhance admin APIs responses with DAX and mashup expressions expandable and ensure this is Enabled.
      1. Under Specific security groups, add the security group created above.
      2. At the bottom of the expanded section, click the Apply button.