Rapid BI Catalog reads Power BI as a service principal — a Microsoft Entra app registration that signs in with a client secret rather than as a person. This page lists every grant that setup requires, what each one buys, and what breaks without it. Granting them is an Microsoft Entra and Power BI administrator task; entering the resulting credentials in Rapid BI Catalog is described in Power BI Service.
What you must grant
Four grants, in the order an administrator works through them. Every one is required; nothing on this page is optional.
| Grant | Why it is needed | Without it |
|---|---|---|
| A Microsoft Entra app registration with a client secret | Rapid BI Catalog exchanges the tenant ID, client ID and secret for an access token using the client-credentials flow | No connection at all |
| The tenant setting that lets service principals call the APIs (see below) | Power BI refuses API calls from service principals until an administrator turns this on tenant-wide | The app authenticates successfully but sees nothing — Test Connection reports zero workspaces |
Member on each workspace you want catalogued | Reads the workspace's reports, their semantic models and data sources, and lists the workspace members — which is what grants your own users access to it | The workspace is unusable by everyone |
Microsoft Graph GroupMember.Read.All (application permission, admin consent) | Expands an Entra ID security group into its individual users, so member discovery can match them | Workspaces shared with a security group discover nobody, and are therefore unusable |
The workspace role
Add the service principal to each workspace as Member. Member is sufficient for everything Rapid BI Catalog does: it can list the workspace's reports and it can list the workspace's members.
Listing members matters more than it looks. Rapid BI Catalog decides which of your users may work with a workspace entirely from its discovered membership — there is no bypass for an administrator. A workspace whose members were never discovered is unusable by everyone, so the role that lets the service principal read the member list is a requirement rather than an enhancement. See Power BI Service for how discovery is run.
When Microsoft Graph is needed
If a workspace is shared with named users, member discovery works with the workspace role alone. If a workspace is shared with an Entra ID security group, Power BI returns the group rather than the people in it, and Rapid BI Catalog needs Microsoft Graph to expand it. Grant GroupMember.Read.All as an application permission with admin consent. Directory.Read.All also works, but it is broader than this needs.
What Rapid BI Catalog reads
Three tokens are acquired for the same app registration, one per API. What each reaches:
| API | What is read |
|---|---|
Power BI REST api.powerbi.com | The list of workspaces, the members of a workspace, the reports in a workspace, each report's dataset and its data sources, and the report file itself |
Microsoft Fabric api.fabric.microsoft.com | The semantic model definition — tables, columns, measures, calculated columns, hierarchies and roles — and the report definition: pages, visuals and bookmarks. This is the metadata Rapid BI Catalog documents |
Microsoft Graph graph.microsoft.com | Expanding an Entra ID security group into its users |
All three hosts, plus login.microsoftonline.com for the tokens themselves, must be reachable from the Rapid BI Catalog server — see the Egress Allowlist.
The tenant setting
A Power BI or Fabric administrator must allow service principals to call the APIs. In the admin portal this is Service principals can call Fabric public APIs, under Developer settings. It can be enabled for the whole organisation or for a security group that contains the service principal.
All access is read-only
Every call Rapid BI Catalog makes to Power BI, Fabric and Microsoft Graph is a read. Nothing is created, modified, published or deleted in your Power BI tenant. The client secret is encrypted at rest and is never returned to the browser.
Next Steps
- Enter the credentials and connect: Power BI Service
- Add the environment in the admin UI: BI Server Configuration
- Open the required outbound hosts: Egress Allowlist