Skip to content

Hardening Checklist

Work through this list after installation and before go-live; each item links to the page with the steps.

Keep a record

Copy this list into your change ticket and tick items as you complete them. Re-check it after every upgrade, after moving MetaMiner to a new server, and after rotating the client secret.

Microsoft tenant

  • Use a dedicated app registration for MetaMiner. Do not reuse an app that other tools use. See Register the Application.
  • Put the app's service principal in a dedicated security group and enable the Fabric tenant settings for that group only. See Security Group for the App and Tenant Settings.
  • Grant Microsoft Graph permissions only if you use the Entra Users and Groups views, and use the granular read permissions rather than the broader directory permission. See API Permissions.
  • Set the client secret expiry to your policy and record the date. Rotate it before it expires and update it in the MetaMiner Administrator (MMA). See Client Secret.
  • Add the service principal to individual workspaces only where you need item definitions or backups.
  • Consent only to the delegated permissions of the MetaMiner Client features you use. See Delegated User Sign-In.
  • Review the MetaMiner Enterprise Applications and their consented permissions in your periodic access review. See Tenant Security Posture.

Network

  • Allow inbound TCP 49714 (or your MetaMiner Server port) only from the networks of MetaMiner Client users and administrators. See Network Exposure.
  • Do not open the Web Apps port 49717 in the firewall. Browsers reach the web apps through the MetaMiner Server port.
  • Allow the MetaMiner Database port (49614 for the embedded database) only from the MetaMiner Server host and from hosts you allow to query the database directly.
  • Limit the rules in the embedded database's pg_hba.conf to the hosts that need access. See MetaMiner Database SSL.
  • Allow outbound HTTPS from the MetaMiner Server host to the Microsoft endpoints only. See Network and Microsoft Endpoints.

Transport encryption

  • Turn on SSL for the MetaMiner Server with a certificate from your company CA. See MetaMiner Server SSL.
  • Add your issuing CA to the trust store of every MetaMiner Client workstation. See Client to Server SSL.
  • Tell users to report any certificate warning in the MetaMiner Client instead of accepting it.
  • Turn on SSL between the MetaMiner Server and the MetaMiner Database when the database is on another host or is read over the network. See MetaMiner Database SSL.
  • Use LDAPS for directory authentication. See Import Users from LDAP or AD.
  • Turn on SSL for the e-mail server connection. See Email.

Access control

  • Create named MetaMiner users, give each the least-privileged role per environment, then turn on MetaMiner Security. See User-Based Security and Users and Roles.
  • Give the Administrator role only to the people who administer MetaMiner.
  • Turn on Enable Power BI SSO so each user signs in to Microsoft and sees only the workspaces their account can access. See Tenant Admin View.
  • Keep Microsoft interactive sign-in on (the default). It applies your Conditional Access and multifactor policies, and MetaMiner never handles the user's Microsoft password.
  • Grant Tenant Admin only to people who are Fabric administrators in your tenant.
  • Grant Tab: Meta Query only to users who may see tenant-wide metadata. The Read Only system role includes it, so create a custom role for users who must not query the database. See Permissions Reference.
  • Authenticate users against LDAP or Active Directory where possible. See Import Users from LDAP or AD.
  • Set the password policy in Preferences > Settings... > General: raise Min password length (default 4), turn on Enforce Password Complexity, and set Password expiration (days), Login failure threshold (default 3) and User Inactive threshold (default 90 days) to your policy.
  • Turn on Notify on any MM security changes in Preferences > Settings... > Notifications and configure e-mail, so administrators hear about user, role and security changes.
  • Turn off web apps you do not use in Preferences > Settings... > WebApps. See Web Apps.

Server host and secrets

  • Limit interactive and remote desktop logon on the MetaMiner Server host to MetaMiner administrators. MMA runs there with full control of the configuration.
  • Restrict NTFS permissions on server\config, server\security, server\data, server\logs and the backup archive folder to administrators and the MetaMiner service account. See What MetaMiner Stores.
  • Keep the MetaMiner Server SSL private key in a folder only administrators and the service account can read.
  • Use a strong password for the MetaMiner Database account.
  • Optionally encrypt the configuration file. See Secrets and Configuration Encryption.
  • Run the MetaMiner services under a dedicated account if they need network shares. See Service Accounts.
  • Store backup archives, exported .pbix files and MMDB dumps with the same protection as the Power BI content they came from. Report files can contain imported data.
  • Install MetaMiner updates when they are released. See Installing New Releases.

Workstations

  • On shared workstations, have users sign out of Microsoft in the MetaMiner Client and use File > Forget Credentials... to remove the saved MetaMiner password. See Connect to a Server.

TODO: supported procedure to change the embedded MMDB account password

The Configure MMDB dialog shows the account and password but has no change-password action in this release. Product team to confirm the supported procedure, then link it from the item above.

Next steps