Security

How MetaMiner for Microsoft Fabric & Power BI protects access, connections and stored metadata, what it does in your Microsoft tenant, and how you harden an installation.

Start with the security model, the tenant security posture and the hardening checklist, then follow the task pages for access control, encryption and network exposure.

Fundamentals

• Security Model

  ---

  The layers that protect MetaMiner: network, TLS, two Microsoft identities, MetaMiner users and roles, Power BI sign-in, database roles and secrets at rest.

• Tenant Security Posture

  ---

  What MetaMiner reads in your tenant, which features write, the permissions and roles they need, and where tokens live.

• Hardening Checklist

  ---

  A task list you work through after installation and before go-live.

• What MetaMiner Stores

  ---

  Tenant metadata, activity events, Entra identities and licences in the MetaMiner Database, and how long they are kept.

Access control

• User-Based Security

  ---

  Turn on MetaMiner Security and Power BI SSO in the MetaMiner Administrator.

• Users and Roles

  ---

  Create MetaMiner users, define roles and assign a role per environment.

• Permissions Reference

  ---

  Every permission relevant to Power BI, and the tab or action it controls.

• Import Users from LDAP or AD

  ---

  Connect a directory, authenticate users against it and import user accounts.

• Tenant Admin View

  ---

  See every workspace in the tenant and use the Power BI admin APIs, for tenant administrators.

Encryption

• SSL Overview

  ---

  A map of every network hop and the page that encrypts it.

• MetaMiner Server SSL

  ---

  Turn on TLS for the MetaMiner Server port.

• Client to Server SSL

  ---

  Make MetaMiner Client workstations trust the server certificate.

• MetaMiner Database SSL

  ---

  Encrypt connections to the MetaMiner Database and limit which hosts may connect.

• Secrets and Configuration Encryption

  ---

  How the client secret and other passwords are protected, encrypting the configuration file, rotating the secret.

• Trusted Certificates

  ---

  Which certificates each component trusts, and networks that inspect TLS.

Network and accounts

• Network Exposure

  ---

  Which ports must be reachable from where, which stay local, and the Microsoft endpoints MetaMiner calls.

• Service Accounts

  ---

  The Windows service account, the Entra app as the tenant identity, signed-in users and database accounts.

Chapter status

• hardening-checklist.md - supported procedure to change the embedded MMDB account password.
• data-stored.md - confirm cleanup of exported report files in the server temporary folder.
• user-based-security.md, users-and-roles.md, tenant-admin-view.md - screenshots of the MMA security dialogs and the MMC toolbar.
• ldap-import.md - Directory Type field; trust store for LDAPS; screenshots.
• mms-ssl.md - decide whether to publish a password-protected key format; dialog screenshot.
• mmdb-ssl.md - confirm the root.crt locations on a live install.
• secrets-encryption.md - removing the plain-text file after encryption; how to turn encryption off.
• trusted-certificates.md - supported procedure for TLS-inspecting proxies and outbound proxy support.
• service-accounts.md - logon accounts of the Web Apps and embedded database services.