Skip to content

Scope and Sign-In

Limit the dashboards' user-population figures to one Entra group, and control who can open the dashboards.

How it works

Two separate things are often confused:

Topic What it controls Where
User-population scope Which users count in the seat, waste, dormancy, never-active, tier-mix and adoption-denominator figures MMA WebApps page, or config\webapps.json
Access Who can open /web/pbiusage/ at all Your network: firewall rules for the MMS port, MMS SSL, and the app switch

The scope is not a security filter. It does not hide workspaces, reports or users from anyone who opens the dashboards, and it does not change capacity, content or activity figures.

Limit the user population to one group

By default the user-population figures cover the whole tenant. If MetaMiner should report seats and adoption for one organisation only (for example one business unit in a shared tenant), set an Entra security group. MetaMiner then counts the members of that group and of all groups nested in it.

Before you begin

  • The Entra group collectors have run at least once, so the group and its members are in the MetaMiner Database (MMDB). See Collection Processors.
  • You know the group's object ID (a UUID such as f1b8757c-ce52-4af2-8567-d1ee85d35e51), from the Microsoft Entra admin center. Display names are not accepted.

Steps

  1. In the MetaMiner Administrator (MMA), choose Preferences > Settings... and select the WebApps page.
  2. In the PowerBI Dashboards group, paste the group's object ID into Usergroup restricted UUID:. Leave it empty to report tenant-wide.

  3. Click Apply.

    Image of the MMA WebApps page, PowerBI Dashboards group, after Apply: the UUID field filled and the status line 'Applied. Scope: . This group currently resolves to N users.'

    ../images/dashboards/mma-webapps-usergroup-applied.png

  4. Read the status line. "This group currently resolves to N users." previews the population.

  5. When the MMA asks whether to restart the MetaMiner Server, choose:
    • No to let the figures rebuild at the next scheduled run of the license-waste job (every 6 hours), or
    • Yes to rebuild them within a minute. Restarting disconnects MetaMiner Clients and interrupts any running collection.

Result: the dashboards pick up the setting within seconds. The Licensing page shows "population: configured usergroup closure (...)" instead of "population: tenant-wide (no usergroup configured)".

Where the setting is stored

Apply writes the value to two places so that both readers agree:

  • server\config\webapps.json, read by the Web Apps service every few seconds:
    server\config\webapps.json
    { "pbiusage": { "scope": { "usergroup": "f1b8757c-ce52-4af2-8567-d1ee85d35e51" } } }
  • the usergroup parameter of the license-waste job in server\silver-jobs\pbi-license-waste\job.json, read at the start of each job run.

An older setting web.apps.pbiusage.scope.usergroup in server\MetaMinerServer.properties is used only when webapps.json does not declare the value. Use the MMA so that both places stay consistent.

Status: "The two configuration channels currently disagree"

Someone edited one of the two files by hand. Press Apply to write the same value to both.

Warning: "No group with that id was found in this tenant's pulled Entra groups"

The group is not in the MMDB yet, or the ID is wrong. Check the ID in the Entra admin center and wait for the next group collection.

Warning: "The group resolved to 0 users"

The group has no members MetaMiner knows of. Check the group ID and that the Entra group membership collector has run.

Warning: silver jobs are disabled

The full text is "The setting is saved, but silver jobs are disabled (silver.jobs.enable=false), so the population closure and the license-waste snapshot will not rebuild until they are enabled." Remove silver.jobs.enable=false from server\MetaMinerServer.properties and restart the MetaMiner Server.

Control who can open the dashboards

The Power BI usage dashboards do not ask users to sign in. Anyone whose browser can reach the MetaMiner Server (MMS) port can open /web/pbiusage/, and the pages show tenant-wide usage, user identities and licence data. Treat the address like an internal report server and decide who may reach it.

Restrict network access to the MMS port

Allow the MMS port (default 49714) only from the networks of the people who should see tenant usage data: Power BI administrators, the BI CoE, and MMC users. Block it everywhere else with the Windows firewall on the MMS machine and your network firewalls.

Control What to do Where
Network access Allow the MMS port only from administrator and MMC-user networks Network Exposure
Encryption Turn on MMS SSL so that dashboard data travels over HTTPS MetaMiner Server SSL
App switch Turn Power BI Usage (/web/pbiusage) off on servers where nobody uses the dashboards Enable the Dashboards
Web Apps port Leave port 49717 loopback-only; it never needs to be opened in the firewall Ports and Endpoints
MMC launcher With user-based security on, only users with the MMC permission on a Power BI environment get an enabled File > Launch Power BI Usage... Users and Roles

The MMC launcher is a convenience, not a gate

The launcher permission decides whether the menu item is enabled in the MMC. It does not stop a browser that has the address. Network access is the control that counts.

TODO: product decision on sign-in for the Power BI usage dashboards

The BO console and Meta Query on the web support MetaMiner sign-in; the Power BI usage dashboards do not. Confirm whether sign-in is planned and update this page when it ships.

Next steps