Setup Checklist¶
One page with every Microsoft setup task for MetaMiner, grouped by who usually does it, so you can track progress and hand values over safely.
Roles involved¶
| Role | Tasks |
|---|---|
| Entra administrator | App registration, client secret, Graph permissions, security group, consent for delegated sign-in |
| Fabric administrator | Tenant settings |
| Workspace or capacity administrator | Capacity Metrics app, workspace roles |
| MetaMiner administrator | Enter the values in the MetaMiner Administrator and validate |
The same person often holds several roles.
Microsoft Entra ID¶
- Register a single-tenant application with no redirect URI. Register the Application
- Record the Directory (tenant) ID and Application (client) ID.
- Create a client secret, copy its Value (not the Secret ID), and record its expiry date. Client Secret
- Add the Microsoft Graph Application permission
Directory.Read.All, or all five ofUser.Read.All,Group.Read.All,GroupMember.Read.All,Application.Read.All,LicenseAssignment.Read.All. API Permissions - Click Grant admin consent and confirm every permission shows as granted.
- Do not add Power BI or Fabric API permissions to the application.
- Create a security group, for example
MetaMiner-ReadOnly, with the application's service principal as its only member. Security Group for the App
Fabric admin portal¶
Enable each setting for the MetaMiner security group only. Tenant Settings
- Service principals can access read-only admin APIs
- Enhance admin API responses with detailed metadata
- Enhance admin API responses with DAX and mashup expressions
- Service principals can use Fabric APIs
- Allow service principals to use Power BI APIs (for Capacity Metrics, dataflow definitions and .pbix export)
Optional: Capacity Metrics¶
- Install and connect the Microsoft Fabric Capacity Metrics app, and refresh it.
- Give the service principal (or its group) Contributor or Admin on the app's workspace.
- Enable Semantic model Execute Queries REST API for the group.
- Record the app's semantic model ID.
Optional: workspace roles¶
- Add the service principal as Admin, Member or Contributor to workspaces whose item definitions you want collected.
- Plan backup: the service principal needs Contributor on backed-up workspaces. MetaMiner can grant it from the backup wizard.
- Give the service principal's group a role on gateways and connections you want inventoried. Gateways and Connections
Optional: delegated sign-in¶
- An Entra administrator grants admin consent to the MetaMiner Client application with the consent link.
- Decide whether to withhold
Tenant.ReadWrite.All(disables Tenant Admin View actions and restore of deleted workspaces). - In the MetaMiner Administrator, select Security > Enable Power BI SSO.
Network¶
Network and Microsoft Endpoints
- Allow outbound HTTPS 443 from the MetaMiner server to the sign-in, Power BI, Fabric and Graph hosts of your cloud.
- Exempt those hosts from TLS inspection.
- Note your cloud: Commercial, US Government, US Government High or US Government Military. Sovereign Clouds
MetaMiner Administrator¶
- Add the Power BI environment: display name, Endpoint Set, Tenant ID, Client ID, Client Secret; leave Username and Password empty.
- Add the Capacity Metrics semantic model ID and select capacities, or select Ignore FCM at this time.
- Click Test Connection: every step passes.
- Click Apply and restart the MetaMiner Server.
Hand over the client secret securely
If someone other than the Entra administrator enters the values, pass the client secret through a one-time secret link or a password vault. Never by e-mail, chat or support ticket. The tenant ID and client ID are not secret.
Image of the Test Connection results dialog with Steps failed: 0
../images/microsoft-setup/mma-test-connection-all-passed.png