Skip to content

Service Accounts

The Windows account that runs the MetaMiner services, the Microsoft Entra app that is MetaMiner's identity in your tenant, the optional signed-in users, and the database accounts, with least-privilege guidance for each.

Windows service accounts

MetaMiner installs these Windows services on the MetaMiner Server host:

Service name Component Default logon account
metaminer MetaMiner Server Local System
MetaMinerWebApps Web Apps (usage dashboards and Meta Query on the web) Set by the installer
InfolytikPostgres Embedded MetaMiner Database, when used Set by the installer

TODO: confirm the logon account of InfolytikPostgres and MetaMinerWebApps

Check sc qc InfolytikPostgres and sc qc MetaMinerWebApps on a fresh install and fill in the table.

Local System works for a single server that keeps all files on local disks. Use a dedicated domain service account when:

  • the backup archive folder is on a network share (UNC path). Local System cannot authenticate to most shares;
  • your policy forbids Local System for application services.

Use a dedicated account for the MetaMiner Server

  1. Create a domain account, for example CORP\svc-metaminer, with a strong password that does not expire, or a managed service account.
  2. Give it Modify on the MetaMiner install folder (C:\Program Files\Infolytik\MetaMiner\server\) and on the backup archive folder.
  3. Give it Log on as a service on the MetaMiner Server host.
  4. Do not make it a local or domain administrator.
  5. In Services, open metaminer, go to Log On, select This account, and enter the account.
  6. Grant the same account read access to the MetaMiner Server SSL key folder, if you use one.
  7. Restart the service.

Upgrades keep a custom logon account on the metaminer service.

The Windows account is not used in Microsoft 365

The Windows service account runs the process and reaches files. MetaMiner reaches your tenant with the Entra app below, or as a signed-in user for user-started actions.

The Entra app: MetaMiner's tenant identity

Each Power BI environment in the MetaMiner Administrator (MMA) has a Tenant ID, Client ID and Client Secret for an app registration you create. Its service principal performs the scheduled read-only pull. See Register the Application.

Requirement Why
Member of a dedicated security group named in the Fabric tenant settings Allows the read-only admin APIs and the Fabric APIs for this app only. See Security Group for the App
Client secret with an expiry you track The pull stops when the secret expires. See Rotate the client secret
Microsoft Graph application permissions, optional Only for the Entra Users and Groups and Licenses views. See API Permissions
Workspace role (Admin, Member or Contributor), optional, per workspace Only where you want item definitions or backups
Access to the Fabric Capacity Metrics workspace, optional Only if you configure capacity metrics. See Capacity Metrics App

Least-privilege practice for this app:

  • Create one app registration for MetaMiner. Do not share it with other tools.
  • Keep the security group limited to the MetaMiner service principal.
  • Prefer the granular Graph read permissions to the broad directory permission, and grant none if you do not need the Entra views.
  • Add the service principal to workspaces only where needed. Grant backup access on the Power BI Backup tab adds it as Contributor, and MetaMiner records who made each grant. See Prerequisites and Access.
  • Review the app's permissions, group membership and workspace roles in your periodic access review.

Signed-in users (optional delegated access)

When Enable Power BI SSO is on, each MetaMiner Client user signs in with their own Microsoft account. Actions such as Manage Access, workspace restore, restore from backup and lakehouse export then run as that user, with that user's Microsoft permissions. No user account or password is stored in MetaMiner for this.

Item Detail
App The MetaMiner sign-in app published by Infolytik, client ID b9b45b30-ea3f-4697-8b0c-c7aab438f3e6
Consent An administrator consents once for the organization; this creates an Enterprise Application you can review or remove
What each user can do Limited by the user's own workspace roles and Microsoft Entra roles, and by their MetaMiner role
Sign-in method Microsoft interactive sign-in by default (pbi.interactive.login.enabled=true in MetaMinerServer.properties)

See Delegated User Sign-In and Tenant Security Posture.

Database accounts

Account Used by Guidance
MMDB account in Configure MMDB MetaMiner Server Owns the MetaMiner schemas. Use a strong password. On an external PostgreSQL server, have your DBA create it and keep it for MetaMiner only
readonly role Read-only MetaMiner features Maintained by MetaMiner. Do not grant it write rights
mq_reader, mq_reader_all Meta Query on the web Maintained by MetaMiner. Read only, with connection and time limits
Your reporting logins Tools that read the MMDB Create them as members of readonly. Remember that the MMDB holds tenant-wide metadata and activity events