Skip to content
Power BI Metrics Book
Not released yet: nothing on these pages installs until 0.1, the first release. Run it on the sample tenant today.

The app registration

People sign in with Microsoft, and query Power BI as themselves, through one app registration in your Entra tenant. This step creates it and gives the setup its three values: the tenant id, the client id and a client secret.

The app registration holds delegated permissions only. It never writes to Power BI and never acts without a person.

Before you start

Section titled “Before you start”
  • A Microsoft Entra account that can register applications (at least Application Developer) and grant admin consent for them (Application Administrator, Cloud Application Administrator or Privileged Role Administrator). Often these are two people.
  • The setup is open at step 2, The app registration. It shows the two redirect URIs to copy.
  • Your address from Address. In this guide it is https://metrics.example.com.

Steps

Section titled “Steps”

  1. Sign in to the Microsoft Entra admin center. If you can reach several tenants, use the Settings icon in the top menu to switch to the one your Power BI lives in.

  2. Browse to Entra ID > App registrations and select New registration.

  3. Fill in the form:

    • Name: Power BI Metrics Book.
    • Supported account types: Single tenant only (it reads Single tenant only - <your tenant>; older portals call it Accounts in this organizational directory only).

  4. Select Register. The Overview page opens. Copy two values into the setup now:

    • Application (client) ID into the setup’s Application (client) ID.
    • Directory (tenant) ID into the setup’s Directory (tenant) ID.

  5. Under Manage, select Authentication. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, paste the first address below and select Configure. Add the second the same way (if the portal already lists the Web platform, add it there). Copy both from the setup’s Values to copy:

    https://metrics.example.com/api/auth/callback/microsoft
    https://metrics.example.com/api/v1/powerbi/callback

    The first brings people back after signing in with Microsoft. The second brings them back after connecting Power BI.

    Source for steps 1 to 5: Microsoft, Register an application in Microsoft Entra ID and How to add a redirect URI to your application. Those pages show Add Redirect URI, Web and Configure for one address. Adding the second the same way follows from them.

  6. Under Manage, select API permissions, then Add a permission. Add these, always as Delegated permissions:

    • Microsoft Graph: select openid, profile, email and offline_access, then Add permissions. A new registration already holds User.Read; if yours does not, add it the same way.
    • On the Microsoft APIs tab, Power BI service: select Dataset.Read.All, then Add permissions.
    Permission What the app uses it for
    openid, profile, email Signing in: who the person is, and the email their roles are matched on.
    offline_access A refresh token, so a person’s Power BI connection keeps working without signing in again.
    User.Read (Microsoft Graph) Reading the person’s own group ids, so access follows their Power BI groups. It needs no admin consent.
    Dataset.Read.All (Power BI service) Running a DAX query as the person, with their own rights.

  7. Leave everything else alone. Add no permission of type Application, and nothing that writes, such as Tenant.ReadWrite.All. The check refuses Tenant.Read.All too, and any permission not in the table. If one is there, select the three dots beside it and Remove permission.

  8. Select Grant admin consent for your tenant’s name, then Yes. Select Refresh and check that Status reads Granted for your tenant for each permission. (Microsoft’s page on admin consent lists who may do this.)

    Source for steps 6 to 8: Microsoft, Configure app permissions for a web API, Change your Microsoft Entra app’s permissions (the Power BI service tab) and Grant tenant-wide admin consent to an application.

  9. Under Manage, select Certificates & secrets, then Client secrets > New client secret. Enter a description such as Power BI Metrics Book, choose an expiry (Microsoft allows at most 24 months and recommends less than 12) and select Add.

  10. Copy the secret’s Value, not its Secret ID. Entra shows the value once. Paste it into the setup’s Client secret value, and enter the expiry date Entra shows in The secret expires on.

    Source for steps 9 and 10: Microsoft, Add and manage application credentials in Microsoft Entra ID.

  11. Press Check the app registration.

What happens after you press the button

Section titled “What happens after you press the button”

The check goes on in four stages. Each one shows what to do next.

  1. It asks Microsoft for a token with your tenant id, client id and secret, and refuses a token that carries an application permission.
  2. The app registration works. Sign in with Microsoft now: you become the first admin. Press Sign in with Microsoft now and sign in with the account that will run this product.
  3. The setup shows the name and email of the person who signed in. Press Make me the admin. The setup link ends and the rest of the setup opens in this browser.
  4. Connect Power BI now, so the check can read what your token allows. Press Connect Power BI. If admin consent is granted, Microsoft shows nothing and sends you back. The check then reads your token’s permissions and passes when they are exactly the ones above.

Steps 3 to 10 of the setup wait for the admin: they stay locked until stage 3 is done.

Check

Section titled “Check”

The step passes when stage 4 ends without a sentence. Run it again later with:

Terminal window
pbmb admin check app_registration
pbmb admin status

pbmb admin status warns 30 and 7 days before the secret expires. When it does, add a new secret in Entra, enter it here and delete the old one. If a sentence appears, find it on When a check fails.

Next: The scanner.