Skip to main content
Connect Microsoft Fabric to Oleria to see who and what can reach your Fabric and Power BI content, and how. Oleria reads your Fabric tenant through the Fabric and Power BI admin APIs with a Microsoft Entra service principal, and adds user and group details from Microsoft Graph. You can review workspace and domain access, and revoke it from Oleria.

​
What Oleria discovers

​
Prerequisites

  • A Microsoft Fabric or Power BI tenant in the commercial cloud.
  • A Fabric Administrator, to change Fabric tenant settings.
  • A Global Administrator or Privileged Role Administrator, to grant admin consent for Microsoft Graph application permissions. A Cloud Application Administrator or Application Administrator can’t grant it.
  • A Groups Administrator or User Administrator, to create a security group for Oleria’s service principal.
  • Optional, for revoking workspace access: an Admin of each workspace where Oleria should revoke access, to add the app as Admin there.
  • Optional: Microsoft Entra ID P1 or P2, for last sign-in, MFA status, and authentication methods. Without it, Oleria still syncs, and those fields show as unavailable.

​
Choose an authentication method

The connection form offers three methods. Pick one:
  1. Authenticate via Microsoft (OAuth), the default. You grant admin consent to Oleria’s Microsoft app. You don’t need to register an app or manage a credential.
  2. Client Secret Authentication. You register your own app in Microsoft Entra ID and give Oleria a client secret.
  3. Client Certificate Authentication. You register your own app and give Oleria a certificate and its private key.
For either manual method, register the app first:
1

Register an application

In the Microsoft Entra admin center, go to Entra ID -> App registrations -> New registration. Name the app (for example, Oleria Fabric) and select Register. On its Overview page, copy the Application (client) ID and Directory (tenant) ID.
2

Create a credential

Select Certificates & secrets -> Client secrets -> New client secret, add a description, choose an expiration, and select Add. Copy the secret’s Value. Microsoft never displays it again after you leave the page. A client secret lasts at most 24 months, so update the integration in Oleria before it expires.
3

Grant Microsoft Graph permissions

Select API permissions -> Add a permission -> Microsoft Graph -> Application permissions. Add these permissions, select Add permissions, then select Grant admin consent for your tenant:
Optionally, also add:
  • AuditLog.Read.All, for last sign-in, MFA status, and authentication methods. It also needs Microsoft Entra ID P1 or P2.
  • Organization.Read.All, so Oleria names the connection after your organization instead of your tenant ID, and matches sign-ins on your verified domains.
Don’t add Power BI Service permissions that require admin consent. Microsoft requires that an app calling the read-only admin APIs has none.
Oleria can’t connect without User.Read.All. Without one of the other required permissions, Oleria still syncs, with less detail:

​
Give the app access to the Fabric APIs

Fabric lets a service principal call its APIs only when tenant settings allow a security group that contains it. Do this for every authentication method. With OAuth, Oleria’s app is added to your tenant when an administrator first grants admin consent to it, so the order is:
  1. Follow Connect Microsoft Fabric to Oleria and grant consent. Note the app name Microsoft shows on the consent screen. Oleria then reports that Microsoft Fabric refused the app, which is expected at this point.
  2. Do the steps below, wait up to 15 minutes, then select Authenticate again.
1

Create a security group with the app in it

In the Microsoft Entra admin center, go to Entra ID -> Groups -> All groups -> New group. Set Group type to Security, name the group, and select Create. Open the group, select Members -> + Add, search for the app by name, and add it. With OAuth, use the name shown on the consent screen. To confirm the name, go to Entra ID -> Enterprise apps -> All applications.
2

Allow the group to use the Fabric APIs

Sign in to Microsoft Fabric as a Fabric Administrator. Select OneLake catalog, select the Govern tab, then select Configurations -> Tenant settings. If Govern isn’t available in your region yet, select the Settings (gear) icon -> Admin portal -> Tenant settings instead.Under Admin API settings, open Service principals can access read-only admin APIs. Set it to Enabled, select Specific security groups, add the security group, and select Apply.Then, under Developer settings, check Service principals can call Fabric public APIs. If it’s enabled for the entire organization, leave it. Otherwise, enable it for the same security group. Microsoft requires this setting for service principals that call the Fabric REST APIs, which Oleria uses to read workspaces, items, and domains. Microsoft enables it by default for new customers.
A tenant setting change can take up to 15 minutes to take effect.
3

Optional: allow remediation

Skip this step if you only want visibility.
  • To revoke workspace roles, make the app an Admin of each workspace where Oleria should revoke access: in the workspace, select Manage access -> Add people or groups, enter the app’s display name (with OAuth, the name shown on the consent screen) or the security group, select the Admin role, and select Add.
  • To revoke domain roles, enable Service principals can access admin APIs used for updates under Admin API settings for the security group.

​
Connect Microsoft Fabric to Oleria

1

Open the integration

Sign in to your Oleria workspace, go to Integrations, and find Microsoft Fabric. Select the + icon (Add Integration for Microsoft Fabric), or Connect in the list view.
2

Complete the connection form

3

Authenticate

Select Authenticate. With OAuth, Microsoft asks an administrator to grant consent, then returns you to Oleria. Before it saves the connection, Oleria checks that it can read users from Microsoft Graph, capacities from the Power BI admin API, and domains from the Fabric admin API.

​
Verify the integration

Confirm that the connection appears on the Connected tab of the Integrations page with a status of Healthy. After the first sync, review users, non-human identities, groups, and workspaces in your Oleria workspace. The integration’s Capabilities and operation readiness section lists the permissions each capability needs. If the first sync fails, check that both tenant settings in Give the app access to the Fabric APIs include the security group.

​
Remediation actions

Oleria offers Revoke permission to resource instance for workspaces and domains when I authorize Oleria to perform write actions in Microsoft Fabric is selected. Each target needs the optional setup in Give the app access to the Fabric APIs. Oleria refuses to revoke:
  • Access to a capacity or to a single item.
  • Access of the Entire organization group. Remove the organization-wide sharing in Fabric instead.
  • The app’s own role on a workspace or domain.
  • The last Admin of a workspace. Fabric doesn’t allow it.
  • A group that is the app’s only path to Admin on the workspace, because Oleria couldn’t revert the change.
  • Workspace access that an account has only through a group. Oleria gives the group’s object ID and role. Remove the account from the group, or remove the group’s role in Fabric.
  • Workspace access where the app isn’t an Admin. Oleria gives the workspace ID, so you can add the app as Admin there.
In Fabric, a removed workspace role takes effect the next time the user signs in to Microsoft Fabric.

​
Known limitations

  • Commercial cloud only. Fabric and Power BI tenants in the US Government and China clouds can’t be connected.
  • Personal workspaces aren’t collected. Oleria reads active shared workspaces and their items. My workspace, inactive workspaces, and inactive capacities aren’t collected.
  • Last activity is the last Microsoft Entra sign-in, not the last use of Fabric. It needs AuditLog.Read.All and Microsoft Entra ID P1 or P2.
  • Activity looks back up to 28 days on the first sync. After that, Oleria reads new events with a one-hour delay.
  • Classic workspaces don’t show their users, because the Fabric scan doesn’t return them.
  • Groups with hidden membership appear without members. Reading them needs Member.Read.Hidden, which Oleria doesn’t request.
  • Eligible role assignments aren’t shown. Oleria reads active assignments of the Global, Fabric, and Power Platform Administrator roles across the whole directory, not Privileged Identity Management (PIM) eligibilities.
  • Not synced: Fabric and Power BI licenses, gateway and connection roles, deployment pipeline roles, and OneLake data access roles.
  • Disabling non-human identities isn’t offered from this integration.

​
Troubleshooting

When Oleria can’t connect, it shows Error creating integration, followed by received invalid inputs. actual error: and one of these messages:

​
Contact us

For questions about this integration, contact us at support@oleria.com.