Skip to content

Client Secret

Create the client secret MetaMiner signs in with, store it safely, and rotate it before it expires.

Before you begin

  • The app registration from Register the Application.
  • Your organization's rule for secret lifetime. MetaMiner imposes no minimum or maximum.
  • A secure way to hand the value to whoever enters it in the MetaMiner Administrator, if that is a different person.

Create the secret

  1. In the Microsoft Entra admin center, open your app registration and select Certificates & secrets.
  2. On the Client secrets tab, click New client secret.
  3. Enter a description, for example MetaMiner <server name>, and choose an expiry that matches your policy.
  4. Click Add.
  5. Copy the Value immediately. Microsoft shows it only once. Do not copy the Secret ID; MetaMiner needs the value.
  6. Record the expiry date in your operations calendar.

Image of the Certificates & secrets page with a new client secret and its Value column

../images/microsoft-setup/entra-client-secret-created.png

TODO: re-check the Certificates & secrets labels against current Microsoft Learn

Source to check: Microsoft Learn, "Add and manage application credentials in Microsoft Entra ID".

Client secret only

The MetaMiner Administrator accepts a client secret for the Power BI environment. Certificate credentials are not offered in the environment dialog.

How MetaMiner stores and uses it

  • The MetaMiner Administrator writes the secret into server\config\config.json in encrypted form. It is never stored in plain text.
  • The server decrypts it in memory only to request tokens from Microsoft. Tokens are kept in memory and never written to disk.
  • The secret stays on your MetaMiner server. You never need to send it to Infolytik.

Never send the secret by e-mail, chat or support ticket

If someone else enters it in the MetaMiner Administrator, use a one-time secret link or a password vault your policy approves. See Secrets and Configuration Encryption.

Rotate the secret

Rotate before the old secret expires. An expired secret stops all collection until you replace it.

  1. In Certificates & secrets, create a new client secret and copy its value. Keep the old one for now.
  2. In the MetaMiner Administrator, select the Power BI environment and click Edit.
  3. Paste the new value into Client Secret.
  4. Click Test Connection and check that every step passes, then click Apply.
  5. Restart the MetaMiner Server so that the collectors use the new secret. See Start and Stop the Server.
  6. Check that server\logs\slc.log shows new Pull ... done lines and that collection continues. See Collection Status.
  7. Delete the old secret in Certificates & secrets.

Image of the Edit Power BI Environment dialog with the Client Secret field highlighted

../images/microsoft-setup/mma-edit-pbi-client-secret.png

Verify

  • Test Connection passes PBI API Token creation and Graph API Token creation.
  • Only one secret, with a future expiry date, remains on the app registration.

Troubleshooting

PBI API Token creation fails with an invalid client secret

The secret has expired, was deleted, or the Secret ID was entered instead of the value. Create a new secret and enter its value.

Collection stopped and the log shows token errors

The secret has expired or was deleted. The collectors keep retrying with an increasing delay but cannot read anything until you enter a valid secret and restart the server. See Collection Problems.

Next steps