The scanner

The scanner reads every workspace’s tables, measures and DAX through Power BI’s read-only admin APIs. It is a second app registration, kept apart from the first so that the internet-facing api never holds a credential that reads the whole tenant. Its secret is readable only by the worker.

The scanner registration holds no API permission at all. Power BI refuses admin APIs to an app that holds one. A tenant setting lets the scanner in instead, and it names a security group.

Before you start

The app registration has passed, and you are the admin.
An Entra account that can register applications and create groups (Groups Administrator or User Administrator).
A Power BI or Fabric administrator, to change tenant settings.

Steps

1. Register the scanner

In the Microsoft Entra admin center browse to Entra ID > App registrations and select New registration.
Name: Power BI Metrics Book scanner. Supported account types: Single tenant only. Add no redirect URI. Select Register.
On the Overview page copy Application (client) ID into the setup’s Application (client) ID on step 3, The scanner.
Select API permissions. A new registration holds User.Read: select the three dots beside it, Remove permission, Yes, remove. The list is now empty. Leave it empty.
Select Certificates & secrets, then Client secrets > New client secret. Choose an expiry and select Add. Copy the Value, not the Secret ID, into Client secret value, and enter the expiry date in The secret expires on.

Source: Microsoft, Register an application in Microsoft Entra ID, Add and manage application credentials and Change your Microsoft Entra app’s permissions (removing a permission).

2. Make the security group

Power BI lets a service principal into its admin APIs only through a security group. A group also keeps the setting narrow: only what you put in it is let in.

Browse to Entra ID > Groups > All groups and select New group.
Group type: Security. It must not be a Microsoft 365 group.
Group name: Power BI Metrics Book scanner. Group description, from the setup’s Values to copy:
```
Lets Power BI Metrics Book's scanner call Power BI's read-only admin APIs.
```
Under Members choose the scanner registration (search for Power BI Metrics Book scanner) and select Select. Select Create.

Source: Microsoft, Manage Microsoft Entra groups and group membership and Enable service principal authentication for admin APIs.

3. Turn on the tenant settings

Sign in to Fabric (app.fabric.microsoft.com) or Power BI with an admin account. Select OneLake catalog, the Govern tab, then Configurations > Tenant settings. Where the OneLake catalog is not available yet, select the Settings (gear) icon > Admin portal > Tenant settings.
Scroll to Admin API settings. Turn on these three, in this order. For each: set the switch to Enabled, choose Specific security groups, enter the group from part 2, and select Apply.
```
Service principals can access read-only admin APIs
Enhance admin APIs responses with detailed metadata
Enhance admin APIs responses with DAX and mashup expressions
```
Wait. A tenant setting can take up to 15 minutes to reach everyone. If the first check says Power BI refused admin APIs, wait and press the button again.

Microsoft renames tenant settings and moves them between sections now and then. If you cannot find a name, look in Admin API settings for the setting that does this:

Setting	What it does
`Service principals can access read-only admin APIs`	Lets the group’s service principals call the read-only admin APIs.
`Enhance admin APIs responses with detailed metadata`	Adds tables, columns and measures to scan results. Needs the first setting.
`Enhance admin APIs responses with DAX and mashup expressions`	Adds the DAX of measures. Needs the one above. The scanner drops the Power Query part before storing anything.

The group can read the metadata of every workspace, with people’s names and emails. Keep only the scanner in it.

Source: Microsoft, About tenant settings (where to find them, and the 15 minutes), Set up metadata scanning and Tenant settings index (the Admin API settings section).

4. Enter the scanner in the setup and check

Enter the client id, the secret value and its expiry from part 1, then press Check the scanner. The check runs in the worker, the only container that can read the secret: a token, the list of changed workspaces, then a scan of one workspace. It takes up to a minute, and the page asks again every few seconds.

Only for service-account queries

Skip this unless you turn on powerbi.service_account_queries. Service accounts then query as the first app registration’s service principal, not as a person.

In Tenant settings > Developer settings, enable Service principals can call Fabric public APIs for the first app registration’s service principal (put it in a security group and name the group). Older portals call it Allow service principals to use Power BI APIs.
In Power BI, open each workspace the queries may reach. From its More menu select Workspace access, add the first registration by its Display name, choose Member, and select Add.

Power BI does not run service-principal queries on a model with row-level security or single sign-on. The people who query those models use their own sign-in, and need the rights in Running DAX for people.

Source: Microsoft, Set up service principal authentication for embedding (steps 3 and 4) and Datasets - Execute Queries (limitations).

Check

Press Check the scanner, or run:

pbmb admin check scanner

It passes with “The scanner read a workspace of the N Power BI lists.” If a sentence appears, find it on When a check fails.

Next: What to sync.