Permissions - Precisely Data Integrity Suite

Authentication requirements

When connecting to the Power BI service hosted in Microsoft Azure cloud, the import bridge uses Entra ID (Azure Active Directory) authentication. This bridge relies on the Microsoft Authentication Library (MSAL) to authenticate.

Register an application in Azure

Complete the following configuration steps to register an application in the Azure global cloud:

1. Connect to the Azure management console at https://portal.azure.com/.
2. Create or open the Azure Active Directory that corresponds to your organization.
3. On the App registrations page, create an application registration named 'MIMB' of type 'Native Client', and record its Client ID (Application ID).
4. Add permission to the Power BI Service application and grant the necessary permissions.

Power BI Service permissions

Grant the following Power BI Service permissions to your application registration:

• Dashboard.Read.All
• Dataflow.Read.All
• Dataset.Read.All
• Gateway.Read.All
• Report.Read.All
• Tenant.Read.All
• Workspace.Read.All

Additional permissions for metadata and querying

To enable specific capabilities, grant these additional permissions:

For downloading Dataset or SemanticModel metadata definitions:

• SemanticModel.ReadWrite.All
• Item.ReadWrite.All

For querying Capacities, Domains, and TenantSettings:

• Tenant.Read.All

National sovereign cloud environments

If you want to register the application in an Azure national sovereign cloud, follow similar steps using a different URL for the Azure management console that matches your government cloud environment. Use the 'Azure environment' parameter to specify your government cloud environment.

For details, refer to Authentication in national clouds.

Authentication modes

The import bridge supports two authentication modes:

• As a regular user: The login user is typically in the form of an email address.
• As a Service Principal: Leave the user name parameter empty and provide the Tenant ID.

Admin API configuration

The import bridge requires the Microsoft enhanced metadata scanning APIs to retrieve DataSets table structure and PowerQuery mashup expressions. These APIs are only available as part of the Admin APIs.

To configure Admin API access for Service Principal authentication, navigate to Power BI Admin Portal Tenant Settings and enable the following settings:

• Developer settings / Service principals can call Fabric public APIs
• Admin API settings / Service principals can access read-only admin APIs
• Admin API settings / Enhance admin APIs responses with detailed metadata (for Dataset Tables and Columns)
• Admin API settings / Enhance admin APIs responses with DAX and mashup expressions (for Dataset lineage metadata)
• Export and sharing settings / Download reports (to enable downloading reports)

API requirements for delegated permissions

When using delegated permissions (login as a signed-in user), the user must have the Power BI Admin Role.

API requirements for Service Principal authentication

When using Service Principal authentication, complete these steps:

1. Remove Power BI Roles given to the app (Tenant.ReadWrite.All, Tenant.Read.All) via the Azure management console.
2. In Azure Active Directory, create a security group and add the Service Principal account to it.
3. Enable access to your workspace(s) to the Service Principal and/or security group:
   1. Log into powerbi.com with your account and select the workspace.
   2. Navigate to Manage Access / Add people or groups.
   3. Select the user, group, or Service Principal account.
   4. Configure it as Admin.
4. For downloading reports, assign the user or group to the workspace(s) as Contributor or Admin.

Using regular APIs instead of Admin APIs

The import bridge can alternatively use regular APIs instead of Admin APIs. To do this, configure the miscellaneous parameter: -api.user.

Note that detailed lineage metadata is not extracted when using regular APIs.

Office 365 Admin Center configuration

You can also use the Office 365 Admin Center to configure users via the Entra ID (Azure Active Directory) management console (bottom left of the screen) and the Power BI subscription (license). Visit https://admin.microsoft.com/ for fine-grained configuration of users, groups, and application registration.