Power BI

Sifflet connects to your Power BI tenant to show which reports, dashboards, and semantic models depend on the tables you monitor in your data warehouse. When an incident affects an upstream table, you see right away which Power BI reports and dashboards are impacted, and from any report you can trace its data back to the warehouse tables that feed it. With the Sifflet Insights browser extension, Power BI users see this data quality status directly in Power BI.

See Power BI Collected Data for the full list of assets and metadata Sifflet imports.

Permissions Required

Sifflet has read-only access to Power BI. It authenticates as a Microsoft Entra ID (formerly Azure Active Directory) service principal, using an app registration and its client secret. Sifflet reads metadata through the Power BI read-only admin APIs (metadata scanning) and never modifies your workspaces, reports, or semantic models.

Power BI grants these permissions through tenant settings applied to a security group that contains the service principal, and through workspace roles:

The Member workspace role is the only non-read permission: Power BI only returns semantic model parameters to workspace members (a Viewer can't read them). Sifflet only reads these parameters. Without this role, Sifflet still catalogs the workspace, but lineage from semantic models whose source expressions use parameters (for example a parameterized server or database name) can be incomplete.

API quotas: at each refresh, Sifflet requests metadata scans of the selected workspaces. These requests count toward the Power BI admin API limits of your tenant, shared with your other tools that use these APIs. Sifflet refreshes BI sources weekly by default to limit this load.

Requirements

Required Roles for Setup

• In Microsoft Entra ID: the rights to register an application and to create a security group (for example the Application Administrator or Cloud Application Administrator role, plus Groups Administrator).
• In Power BI: the Fabric Administrator (formerly Power BI Administrator) role, to change tenant settings in the Admin portal, and the Admin role on each workspace to add the service principal as a member.
• In Sifflet: the Admin role to create the credential, and the Admin or Editor role to create the source.

Supported Versions and Editions

Sifflet supports the Power BI service in the Microsoft global cloud (api.powerbi.com). Power BI Report Server (on-premises) and the Power BI national and government clouds are not supported.

Network Access

Power BI is a SaaS service: Sifflet connects to the Power BI REST APIs (api.powerbi.com) and to Microsoft Entra ID (login.microsoftonline.com) over the internet.

• IP allowlisting: if you restrict access to your tenant with Microsoft Entra Conditional Access policies for workload identities, allow the IP addresses of your Sifflet instance, listed in Settings > Integration Preferences.

Other Prerequisites

• To see lineage from Power BI to your data warehouse, add the warehouse tables to Sifflet first through their own source (Snowflake, BigQuery, Redshift, Databricks, or Synapse). See Lineage.

Connect Sifflet to Power BI

Step 1: Create a Service Principal in Microsoft Entra ID

This step creates the service principal Sifflet uses, puts it in a security group, and grants the group the permissions listed in Permissions Required. Microsoft documents these procedures in Embed Power BI content with service principal (steps 1 to 4) and Enable service principal authentication for read-only admin APIs.

Register the App and Create a Client Secret

1. In the Microsoft Entra admin center, go to Identity > Applications > App registrations and click New registration.
2. Enter a name (for example sifflet), keep Accounts in this organizational directory only, leave the redirect URI empty, and click Register.
3. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
4. Go to Certificates & secrets > Client secrets and click New client secret. Choose an expiry and click Add.
5. Copy the secret Value (not the Secret ID).

Don't add any Power BI API permission that requires admin consent to the app (API permissions page): Power BI rejects service principals with such permissions on the read-only admin APIs. Sifflet needs no API permission on the app.

⚠️ Microsoft Entra ID shows the secret value only once, right after you create it. The secret expires at the date you chose: before it expires, create a new client secret and update the Sifflet credential in Integrations > Credentials.

Create a Security Group for the Service Principal

1. In the Microsoft Entra admin center, go to Identity > Groups > All groups and click New group.
2. Select the Security group type, enter a name (for example sifflet-power-bi), and click Create.
3. Open the group, go to Members > Add members, search for the app you registered, and add it.

Enable the Power BI Tenant Settings

1. In Power BI, go to Settings > Admin portal > Tenant settings.
2. Under Admin API settings, enable the following settings, and for each one select Specific security groups and add the security group:
   • Service principals can access read-only admin APIs
   • Enhance admin APIs responses with detailed metadata
   • Enhance admin APIs responses with DAX and mashup expressions
3. Optional, together with the Member workspace role (see below): under Developer settings, enable Service principals can use Fabric APIs, select Specific security groups, and add the security group.

📝 Note: Power BI can take up to 15 minutes to apply tenant setting changes.

Optional: Add the Service Principal to Your Workspaces

To get complete lineage for semantic models that use parameters, add the service principal to each workspace you want to catalog with the Member role:

1. In Power BI, open the workspace and click Manage access.
2. Click Add people or groups, search for the app (or the security group), select the Member role, and click Add.

You now have the tenant ID, the client ID, and the client secret value needed for step 2.

Step 2: Add the Power BI Source in Sifflet

1. Create the credential: in Integrations > Credentials, click New credential, enter a name, and paste the client secret value as the credential. The credential is the secret value alone, with no JSON wrapping:

   Text

   <CLIENT_SECRET_VALUE>

   

2. Create the source: in Integrations > Sources, click New source, select Power BI, and fill in the following fields:

   Field	Description	Example
   Source name	A name for the source in Sifflet	Power BI
   Azure AD tenant id	The Directory (tenant) ID from the app's Overview page in Microsoft Entra ID	12345678-1234-1234-1234-123456789012
   Azure AD client id	The Application (client) ID from the app's Overview page in Microsoft Entra ID	12345678-1234-1234-1234-123456789012
   Credential	The credential you created above	power-bi-client-secret

   

3. Select the scope: click Load assets to list the workspaces of your tenant, then select the workspaces to catalog. Enable Automatically include new workspaces so that Sifflet also catalogs workspaces created later. See Integrations Management for the refresh frequency and the other generic source settings.

4. Test and save: click Test to check that Sifflet can authenticate and reach Power BI. If the test fails or returns warnings, click Display report to see the details. Then click Save & Run. Sifflet starts a first refresh: follow its status and logs in the source details (click the source name in Integrations > Sources). Power BI assets appear in the Data Catalog when the refresh completes; its duration depends on the number and size of the selected workspaces.

Troubleshooting

See Power BI Troubleshooting for authentication errors, missing permissions, and incomplete lineage.