Microsoft Power BI setup - Configview Support

ConfigView reads your Power BI and Microsoft Fabric tenant (every workspace, who can open it, and the reports, semantic models and dashboards inside it) through Microsoft’s admin scanner API, signing in as a Microsoft Entra app registration (a service principal). It is the same app registration you may already have set up for the Azure, Microsoft 365 and Power Platform integrations, so there is usually no new credential to create. What is new is a one-time tenant setting in the Fabric admin portal that allows service principals to call read-only admin APIs (Step 2). You will end up with 3 required secrets in ConfigView: MSFT_TENANT_ID, MSFT_CLIENT_ID and MSFT_CLIENT_SECRET_VALUE, shared with the other Microsoft integrations. There are no optional secrets.

This integration shares the Entra app registration with the other Microsoft integrations. If any of them is already connected, the three MSFT_* secrets are already saved. Rotating the app’s client secret affects all of them. Power BI has its own page and its own tables (pbi_*).

What ConfigView reads, and what it never reads. ConfigView collects workspaces (shared and personal “My workspace”), the admins, members, contributors and viewers of each workspace (guests included), reports, semantic models (datasets) and dashboards with their owner and who each one is shared with, the data sources each dataset reads (type, server, database and the host of a web address), and content published to the web or shared with the whole organization. It never asks the scanner for DAX or Power Query (M) expressions or table schemas, which can hold connection strings and keys. It never reads report data, descriptions, tile contents, file paths or full web addresses, and never stores a publish-to-web link. It never creates, changes or deletes anything.

What you need

A Microsoft Entra app registration (see Azure setup, Part 1 if you do not have one) with a client secret. You do not add any Entra “API permissions” for Power BI. In fact the app must not have admin-consented Power BI Service permissions such as Tenant.Read.All: Microsoft refuses admin API calls from a service principal that has them. If someone added them, remove them and revoke the consent.
A person with the Fabric Administrator (formerly Power BI Administrator) or Global Administrator role, for Step 2.
A person who can manage an Entra security group (an Entra admin or the group’s owner), for Step 2.
A Power BI tenant in the commercial cloud. Sovereign clouds (GCC, GCC High, DoD, China) use other hosts; tell us and we will set PBI_API_BASE for you.

Step 1: Open the Power BI page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/power-bi

Step 2: Allow the app to use read-only admin APIs

Microsoft lets a service principal call the admin APIs only through a security group named in a tenant setting.

Create or pick a security group. In the Entra admin center go to Groups → All groups → New group, type Security, for example ConfigView Power BI readers. A Microsoft 365 group will not work.
Add the app’s service principal to it. Open the group → Members → Add members, search for the app registration’s name (it appears as an enterprise application) and add it.
Turn on the tenant setting. In Power BI or Fabric, open Settings → Admin portal → Tenant settings → Admin API settings and enable Service principals can access read-only admin APIs (Microsoft also calls it “Allow service principals to use read-only admin APIs”). Choose Specific security groups and add the group from step 1. Apply.
Wait about 15 minutes. Tenant settings take up to 15 minutes to reach the API.

Microsoft documents this in Enable service principal authentication for read-only admin APIs and Run metadata scanning. You do not need the settings “Enhance admin APIs responses with detailed metadata” or “Enhance admin APIs responses with DAX and mashup expressions”. ConfigView does not ask for that detail; leave them as they are. What this grants. The app can read metadata about every workspace in the tenant, including personal workspaces: names, members, item names, owners and sharing. It cannot read report data or change anything.

Step 3: Enter the Entra app in ConfigView

If Azure, Microsoft 365 or Power Platform is already connected, MSFT_TENANT_ID, MSFT_CLIENT_ID and MSFT_CLIENT_SECRET_VALUE are already filled in. Otherwise paste the Directory (tenant) ID, Application (client) ID and the client secret Value (not the Secret ID). ConfigView requests its token for the Power BI service (https://analysis.windows.net/powerbi/api/.default) with the same client credentials. There is nothing to enter for it.

Step 4: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/power-bi, confirm the credentials show as saved.
Click Connect. ConfigView creates its tables and schedules both collectors at your default run time:

Script	Notes
Workspaces, Content and Access (scan)	Lists every workspace, then scans them 100 at a time: workspaces, workspace roles, reports, datasets, dashboards, who each item is shared with, and the data sources behind each dataset. Writes seven tables.
Published to Web and Org-wide Links	Reports and dashboards published to the web, and share links that work for everyone in the organization, with who shared them.

Click Verify now. The health check reads the secrets, gets a token, asks the scanner which workspaces changed in the last hour, and tries the published-to-web list.

If a check fails:

Entra token fails. The tenant ID, client ID or secret is wrong, the secret expired, or the app isn’t in that tenant.
Scanner API fails with HTTP 401 or 403. The tenant setting in Step 2 is off, names a different group, or the app’s service principal is not in the group; it has been less than 15 minutes; or the app has admin-consented Power BI Service permissions (remove them).
Published to web shows as skipped. Microsoft refused that endpoint. The scan still works.

Data Tables

Once the scripts run, these tables are created in your database. Each table has a run_at column and keeps only the newest run.

Table	Source	Key Columns
`pbi_workspaces`	scanner `scanResult`	workspace_id, name, workspace_type, is_personal, state, report_count, dataset_count, dashboard_count, admin_count, external_user_count, artifact_external_user_count
`pbi_workspace_users`	scanner, workspace `users`	workspace_name, role (Admin / Member / Contributor / Viewer), principal_type, email, user_type, is_external
`pbi_reports`	scanner, workspace `reports`	name, report_type, dataset_id, created_by, modified_time, endorsement, sensitivity_label_id, shared_with_count, external_user_count
`pbi_datasets`	scanner, workspace `datasets`	name, configured_by (owner), target_storage_mode, datasource_count, shared_with_count, external_user_count
`pbi_dashboards`	scanner, workspace `dashboards`	name, tile_count, shared_with_count, external_user_count
`pbi_artifact_users`	scanner, `users` of each report, dataset and dashboard	artifact_type, artifact_name, access_right, is_owner, email, user_type, is_external
`pbi_datasources`	scanner `datasourceInstances` + each dataset’s `datasourceUsages`	dataset_name, datasource_type, server, database_name, url_host, gateway_id
`pbi_widely_shared`	`GET admin/widelySharedArtifacts/publishedToWeb` and `/linksSharedToWholeOrganization`	access_type (PublishedToWeb / OrganizationLink), artifact_name, artifact_type, sharer_email

is_external is 1 when Microsoft marks the person as a guest (userType Guest or External) or their identifier carries Entra’s #EXT# guest marker.

Things worth knowing

Microsoft’s rate limits. The scanner allows 30 workspace-list calls, 500 scan requests and 500 scan results an hour per tenant, at most 16 scans at once and 100 workspaces per scan. ConfigView keeps 8 scans in flight, stops after 400 scans (40,000 workspaces) or 25 minutes and keeps what it scanned, and mails you a partial-run notice if that happens. The widely shared endpoints allow 200 calls an hour; that script reads at most 60 pages. Other tools reading the same APIs (Microsoft Purview, a data catalog) share these limits. Every run is a full scan. ConfigView asks for every workspace each time rather than only the ones that changed, so deleted items and removed people disappear on the next run. Personal workspaces are included. “My workspace” content shared with colleagues is one of the things ConfigView looks for. Microsoft returns personal workspaces as type PersonalGroup. Dataset owner. Microsoft reports the person who last took over a dataset (configuredBy). A dataset whose owner has left keeps that email; ConfigView compares it with the Microsoft 365 user list and with the workspace’s members. Deleted workspaces. Workspaces Microsoft is still holding after deletion appear with state Deleted. The catalog checks ignore them.

​What you need

​Step 1: Open the Power BI page in ConfigView

​Step 2: Allow the app to use read-only admin APIs

​Step 3: Enter the Entra app in ConfigView

​Step 4: Connect and verify

​Data Tables

​Things worth knowing