Prerequisites and Access¶
Backup and restore need a MetaMiner permission, a service principal that can reach each workspace, your own Microsoft sign-in for granting access and restoring, and disk space for archives.
Checklist¶
| Requirement | Needed for | Where to set it |
|---|---|---|
| A Power BI environment, enabled and collected | Backup and restore | Add an Environment |
| The environment loaded in the MMC Power BI Explorer | Picking what to back up; choosing a model when binding a report | Power BI Explorer |
| MetaMiner permission Tenant Admin for your MetaMiner user | Every backup and restore action | Users and Roles |
| Service principal is a member of each workspace you back up | Backup runs | The Access step of the wizard, or Power BI workspace access |
| Fabric tenant setting Service principals can use Fabric APIs enabled for the app's security group | Backup runs (item lists and definition export) | Tenant Settings |
| Delegated (interactive) sign-in configured for the environment | Granting access from the wizard; every restore | Delegated User Sign-In |
| A backup archive folder with enough free space | Backup runs | MMA Settings > Backup > Backup Archive Path |
| Email configured in MMA | Run notifications |
TODO: confirm which MetaMiner editions include Power BI backup and restore
Source to check: licensing matrix. The archive folder is enabled by the same license feature as alerting.
MetaMiner permission¶
Every backup and restore action runs on MMS and requires the MetaMiner Tenant Admin permission for Power BI: listing jobs and archives, saving, running, deleting, viewing archive contents and restoring. Grant it in MMA to each user who manages backups. See Permissions Reference.
Service principal access to workspaces¶
Backups run as the service principal configured on the environment (its Microsoft Entra ID app registration). Power BI only lets it read a workspace's content if it is a member of that workspace.
The wizard's Access step checks each selected workspace and shows has access, needs grant or couldn't verify. Grant (or Grant all) adds the service principal to the workspace as a Contributor, using your own account:
- MetaMiner tries the grant with your workspace rights. You need a workspace role that can add people (Admin or Member).
- If that is refused, it tries again through the Power BI admin API, which succeeds only if you are a Fabric administrator.
The grant is additive: nothing existing changes, and Contributor cannot manage access or delete the workspace. Deleting a backup job does not remove the grant; remove the service principal from the workspace in Power BI if it no longer needs access.
Saving a job checks access
When you save a job, MMS checks the service principal's access again. A job that includes a workspace the service principal cannot reach is saved as Invalid and does not run until the access is fixed and the job is saved again.
Your Microsoft sign-in for restore¶
A restore writes as you, not as the service principal, so it can only write into workspaces you can write to yourself. The MMC asks you to sign in to Microsoft the first time a restore needs it. The delegated permissions it asks for depend on what you restore:
| Delegated permission (Power BI) | Asked for when |
|---|---|
Workspace.ReadWrite.All |
Every restore, and every Grant on the Access step |
Dataflow.ReadWrite.All |
The restore includes a Dataflow Gen1 or Dataflow Gen2 without CI/CD |
Content.Create and Dataset.ReadWrite.All |
The restore includes a paginated report, a Gen1 or legacy Gen2 dataflow, or report data (.pbix) |
Capacity.Read.All |
You define a new workspace and MetaMiner lists capacities |
Capacity.ReadWrite.All |
You put a new workspace on a capacity |
Add these as delegated permissions on the app registration and grant admin consent if your tenant requires it. See API Permissions.
Archive storage¶
Archives are written by the MMS Windows service. Set the folder in MMA under Settings > Backup > Backup Archive Path and press Validate.
- Use a local or UNC path. The account the MetaMiner Server service runs as needs read and write access to it. For a UNC path, run the service under a domain account that has access to the share. See Service Accounts.
- Size the folder for the number of jobs, how often they run, and how long they keep archives. Archives that include
.pbixdata are much larger than definition-only archives.
Image of the MMA Settings dialog, Backup page, with the Backup Archive Path field and Validate button
../images/backup-restore/mma-backup-archive-path.png
TODO: give a sizing rule of thumb for archive storage
Source to check: archive sizes from a reference tenant (definition-only vs. with .pbix).