Permissions Reference¶
Every MetaMiner permission that matters in a Power BI installation, the group it appears under in the role editor, and the tab or action it controls.
Permission names below match the Permissions tree in Security > Define Roles... in the MetaMiner Administrator (MMA). Permissions take effect only while MetaMiner Security is on; see User-Based Security.
How permissions apply¶
| Rule | Detail |
|---|---|
| Per environment | A user's role is set per environment, so a permission is granted or not in each environment separately |
| MetaMiner Client access | Every role except No Access includes MetaMiner Client access. It is added automatically and not shown in the tree |
| Server-side checks | The MetaMiner Server checks the permission for each protected request, so hiding a menu is not the only control |
| Microsoft still decides | A MetaMiner permission lets the user try an action. Actions that run as the signed-in user also need the Microsoft permission and role described in Tenant Security Posture |
| Common tabs | Tab: Meta Query and Tab: Alerts must be granted in every environment the user loads in a session. One environment without it hides the tab |
| PowerBI permissions | Checked against the environment of the selected object. Tenant Admin shows the Entra Users/Groups tab and the Tenant Admin View toggle when any loaded Power BI environment grants it |
Tip
If a user needs a tab for one environment only, have them load that environment alone in the Connection Manager, or grant the tab permission in every environment they load together.
PowerBI¶
| Permission | Controls | Where in the MetaMiner Client |
|---|---|---|
| View Security | Shows who has access to the selected Power BI objects, including inherited access through groups | Power BI Explorer: right-click > Explore Security > Selection Only or Selection and Children. See Security Matrix |
| View Activities | Shows Power BI activity events for an item or for several workspaces | Power BI Explorer: right-click > View > View Activities |
| Open in Default Browser | Opens the selected object in Power BI in your browser | Power BI Explorer: right-click > Open in Default Browser |
| Tenant Admin | Tenant-wide views and admin actions: the Tenant Admin View, the Entra Users/Groups tab (including Licenses), restoring deleted workspaces, Manage Access in the Tenant Admin View, and every action on the Power BI Backup tab | Power BI Explorer toolbar: Tenant Admin View. Entra Users/Groups tab. Power BI Backup tab. See Tenant Admin View |
Grant Tenant Admin to Fabric administrators only
Tenant Admin shows every workspace in the tenant and allows admin actions. The admin actions also need the signed-in user to be a Fabric Administrator in Microsoft Entra ID.
Common¶
| Permission | Controls |
|---|---|
| Tab: Meta Query | Shows the Meta Query tab, which runs SQL over the MetaMiner Database and returns tenant-wide metadata. Also allows sign-in to Meta Query on the web. See Meta Query |
| Delete Meta Query scripts from catalog | Deletes Meta Query scripts from the script catalog on the MetaMiner Server |
| Tab: Alerts | Shows the Alerts tab |
| Tab: Backup/Promote | Not used in a Power BI-only installation. Power BI backup is controlled by Tenant Admin |
| Tab: Visual Diff | Not used in a Power BI-only installation |
Actions without a separate permission¶
These actions are available to every user who has MetaMiner Client access in the environment. To withhold them, give the user No Access in that environment.
| Action | Notes |
|---|---|
| Browse the Power BI Explorer, filters, search, export to CSV or Excel | With Power BI SSO on, limited to the user's own workspaces |
| Impact Analysis | Limited to what the explorer shows the user |
| Archive content... (Export PBIX Files) | Downloads report files with the MetaMiner service principal |
| Manage Access... (Manage Workspace Access) | Needs Power BI SSO. Runs as the signed-in user, so Microsoft allows changes only where that user is a workspace Admin. In the Tenant Admin View it needs Tenant Admin |
| Export to Fabric Lakehouse | Needs Microsoft interactive sign-in. Writes as the signed-in user |
Permissions for other platforms¶
The role editor also lists permissions under SAP BO, Tableau and Snowflake. They apply only to environments of that platform and have no effect in a Power BI-only installation.