Power BI Permissions

What you must grant before Rapid BI Catalog can catalogue your Power BI content, and why each grant is needed

App registrationService principalMicrosoft GraphAdmin only

Rapid BI Catalog reads Power BI as a service principal — a Microsoft Entra app registration that signs in with a client secret rather than as a person. This page lists every grant that setup requires, what each one buys, and what breaks without it. Granting them is an Microsoft Entra and Power BI administrator task; entering the resulting credentials in Rapid BI Catalog is described in Power BI Service.

Licence Required
Power BI connectivity requires the Power BI licence feature. If your licence does not include it, the Power BI configuration is not available anywhere in the product.

What you must grant

Four grants, in the order an administrator works through them. Every one is required; nothing on this page is optional.

GrantWhy it is neededWithout it
A Microsoft Entra app registration with a client secretRapid BI Catalog exchanges the tenant ID, client ID and secret for an access token using the client-credentials flowNo connection at all
The tenant setting that lets service principals call the APIs (see below)Power BI refuses API calls from service principals until an administrator turns this on tenant-wideThe app authenticates successfully but sees nothing — Test Connection reports zero workspaces
Member on each workspace you want cataloguedReads the workspace's reports, their semantic models and data sources, and lists the workspace members — which is what grants your own users access to itThe workspace is unusable by everyone
Microsoft Graph GroupMember.Read.All (application permission, admin consent)Expands an Entra ID security group into its individual users, so member discovery can match themWorkspaces shared with a security group discover nobody, and are therefore unusable

The workspace role

Add the service principal to each workspace as Member. Member is sufficient for everything Rapid BI Catalog does: it can list the workspace's reports and it can list the workspace's members.

Listing members matters more than it looks. Rapid BI Catalog decides which of your users may work with a workspace entirely from its discovered membership — there is no bypass for an administrator. A workspace whose members were never discovered is unusable by everyone, so the role that lets the service principal read the member list is a requirement rather than an enhancement. See Power BI Service for how discovery is run.

When Microsoft Graph is needed

If a workspace is shared with named users, member discovery works with the workspace role alone. If a workspace is shared with an Entra ID security group, Power BI returns the group rather than the people in it, and Rapid BI Catalog needs Microsoft Graph to expand it. Grant GroupMember.Read.All as an application permission with admin consent. Directory.Read.All also works, but it is broader than this needs.

What Rapid BI Catalog reads

Three tokens are acquired for the same app registration, one per API. What each reaches:

APIWhat is read
Power BI REST api.powerbi.comThe list of workspaces, the members of a workspace, the reports in a workspace, each report's dataset and its data sources, and the report file itself
Microsoft Fabric api.fabric.microsoft.comThe semantic model definition — tables, columns, measures, calculated columns, hierarchies and roles — and the report definition: pages, visuals and bookmarks. This is the metadata Rapid BI Catalog documents
Microsoft Graph graph.microsoft.comExpanding an Entra ID security group into its users

All three hosts, plus login.microsoftonline.com for the tokens themselves, must be reachable from the Rapid BI Catalog server — see the Egress Allowlist.

The tenant setting

A Power BI or Fabric administrator must allow service principals to call the APIs. In the admin portal this is Service principals can call Fabric public APIs, under Developer settings. It can be enabled for the whole organisation or for a security group that contains the service principal.

All access is read-only

Every call Rapid BI Catalog makes to Power BI, Fabric and Microsoft Graph is a read. Nothing is created, modified, published or deleted in your Power BI tenant. The client secret is encrypted at rest and is never returned to the browser.

Next Steps