> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Fabric > Connect Microsoft Fabric, Power BI included, to Oleria to discover capacities, domains, workspaces, and items, the users, groups, and non-human identities that can reach them, and Fabric and Power BI audit activity. Connect Microsoft Fabric to Oleria to see who and what can reach your Fabric and Power BI content, and how. Oleria reads your Fabric tenant through the Fabric and Power BI admin APIs with a Microsoft Entra service principal, and adds user and group details from Microsoft Graph. You can review workspace and domain access, and revoke it from Oleria. ## What Oleria discovers | Area | Detail | | :- | :- | | **Users** | Every Microsoft Entra user who holds Fabric access, directly or through a group: a workspace role, a permission on an item, a capacity admin right, a domain role, or one of the Microsoft Entra roles below. Guests are marked as external. Each user has their last Microsoft Entra sign-in, multi-factor authentication (MFA) status, registered authentication methods, and last password change. Global, Fabric, and Power Platform Administrators, capacity admins, domain admins, and workspace Admins are flagged as administrators. | | **Non-human identities** | Service principals, managed identities, and service principal profiles that hold Fabric access. Each profile is linked to the service principal that owns it. | | **Groups** | Microsoft Entra groups that hold Fabric access, with their members and nested groups. Access granted to your whole organization appears as an **Entire organization** group that contains every enabled member (non-guest) user. | | **Roles** | The Microsoft Entra **Global Administrator**, **Fabric Administrator**, and **Power Platform Administrator** roles, with the users, groups, and service principals assigned to them across the whole directory. | | **Resources and access** | Active capacities and their admins, domains and subdomains with their admins and contributors, active shared workspaces with their Admin, Member, Contributor, and Viewer role holders, and the items in those workspaces. Items show the user permissions that the Fabric scan reports for them, such as a report shared with a user. | | **Activity** | The Fabric and Power BI activity log, including sharing, access changes, item and workspace changes, exports and downloads, report and dashboard views, and setting changes. | ## Prerequisites * A Microsoft Fabric or Power BI tenant in the commercial cloud. * A **Fabric Administrator**, to change Fabric tenant settings. * A **Global Administrator** or **Privileged Role Administrator**, to grant admin consent for Microsoft Graph application permissions. A Cloud Application Administrator or Application Administrator can't grant it. * A **Groups Administrator** or **User Administrator**, to create a security group for Oleria's service principal. * Optional, for revoking workspace access: an **Admin** of each workspace where Oleria should revoke access, to add the app as Admin there. * Optional: **Microsoft Entra ID P1 or P2**, for last sign-in, MFA status, and authentication methods. Without it, Oleria still syncs, and those fields show as unavailable. ## Choose an authentication method The connection form offers three methods. Pick one: 1. **Authenticate via Microsoft (OAuth)**, the default. You grant admin consent to Oleria's Microsoft app. You don't need to register an app or manage a credential. 2. **Client Secret Authentication**. You register your own app in Microsoft Entra ID and give Oleria a client secret. 3. **Client Certificate Authentication**. You register your own app and give Oleria a certificate and its private key. For either manual method, register the app first: **1. Register an application** In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** -> **App registrations** -> **New registration**. Name the app (for example, `Oleria Fabric`) and select **Register**. On its **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID**. **2. Create a credential** > [tab] Client secret > > Select **Certificates & secrets** -> **Client secrets** -> **New client secret**, add a description, choose an expiration, and select **Add**. Copy the secret's **Value**. Microsoft never displays it again after you leave the page. A client secret lasts at most 24 months, so update the integration in Oleria before it expires. > [tab] Client certificate > > Select **Certificates & secrets** -> **Certificates** -> **Upload certificate**, choose the public certificate (`.cer`, `.pem`, or `.crt`), and select **Add**. Combine the certificate and its unencrypted private key into one PEM file, then base64-encode the whole file. You paste that base64 string into Oleria's **Client Certificate** field. Update the integration in Oleria before the certificate expires. **3. Grant Microsoft Graph permissions** Select **API permissions** -> **Add a permission** -> **Microsoft Graph** -> **Application permissions**. Add these permissions, select **Add permissions**, then select **Grant admin consent for** your tenant: ``` User.Read.All Application.Read.All GroupMember.Read.All RoleManagement.Read.Directory ``` Optionally, also add: * `AuditLog.Read.All`, for last sign-in, MFA status, and authentication methods. It also needs Microsoft Entra ID P1 or P2. * `Organization.Read.All`, so Oleria names the connection after your organization instead of your tenant ID, and matches sign-ins on your verified domains. > [!WARNING] > > Don't add Power BI Service permissions that require admin consent. Microsoft requires that an app calling the read-only admin APIs has none. Oleria can't connect without `User.Read.All`. Without one of the other required permissions, Oleria still syncs, with less detail: | Permission | Without it | | :- | :- | | `GroupMember.Read.All` | Groups appear without their members. Revoking workspace access fails for a user or group that holds no direct role there while a group does, because Oleria can't check its group memberships. | | `RoleManagement.Read.Directory` | Holders of the Global, Fabric, and Power Platform Administrator roles aren't shown. | | `Application.Read.All` | Service principals appear only with the details Fabric reports, and activity by service principals isn't linked to them. Revoking workspace access fails when it needs to check the groups Oleria's app belongs to, or the groups of a service principal that holds no direct role there. | ## Give the app access to the Fabric APIs Fabric lets a service principal call its APIs only when tenant settings allow a security group that contains it. Do this for every authentication method. With OAuth, Oleria's app is added to your tenant when an administrator first grants admin consent to it, so the order is: 1. Follow [Connect Microsoft Fabric to Oleria](#connect-microsoft-fabric-to-oleria) and grant consent. Note the app name Microsoft shows on the consent screen. Oleria then reports that Microsoft Fabric refused the app, which is expected at this point. 2. Do the steps below, wait up to 15 minutes, then select **Authenticate** again. **1. Create a security group with the app in it** In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** -> **Groups** -> **All groups** -> **New group**. Set **Group type** to **Security**, name the group, and select **Create**. Open the group, select **Members** -> **+ Add**, search for the app by name, and add it. With OAuth, use the name shown on the consent screen. To confirm the name, go to **Entra ID** -> **Enterprise apps** -> **All applications**. **2. Allow the group to use the Fabric APIs** Sign in to [Microsoft Fabric](https://app.fabric.microsoft.com) as a Fabric Administrator. Select **OneLake catalog**, select the **Govern** tab, then select **Configurations** -> **Tenant settings**. If **Govern** isn't available in your region yet, select the **Settings** (gear) icon -> **Admin portal** -> **Tenant settings** instead. Under **Admin API settings**, open **Service principals can access read-only admin APIs**. Set it to **Enabled**, select **Specific security groups**, add the security group, and select **Apply**. Then, under **Developer settings**, check **Service principals can call Fabric public APIs**. If it's enabled for the entire organization, leave it. Otherwise, enable it for the same security group. Microsoft requires this setting for service principals that call the Fabric REST APIs, which Oleria uses to read workspaces, items, and domains. Microsoft enables it by default for new customers. > [!NOTE] > > A tenant setting change can take up to 15 minutes to take effect. **3. Optional: allow remediation** Skip this step if you only want visibility. * To revoke workspace roles, make the app an **Admin** of each workspace where Oleria should revoke access: in the workspace, select **Manage access** -> **Add people or groups**, enter the app's display name (with OAuth, the name shown on the consent screen) or the security group, select the **Admin** role, and select **Add**. * To revoke domain roles, enable **Service principals can access admin APIs used for updates** under **Admin API settings** for the security group. ## Connect Microsoft Fabric to Oleria **1. Open the integration** Sign in to your Oleria workspace, go to **Integrations**, and find **Microsoft Fabric**. Select the **+** icon (**Add Integration for Microsoft Fabric**), or **Connect** in the list view. **2. Complete the connection form** | Field | Notes | | :- | :- | | Authentication Method | **Authenticate via Microsoft (OAuth)** (default), **Client Secret Authentication**, or **Client Certificate Authentication**. | | Tenant Id | Client secret or certificate only. The **Directory (tenant) ID** of your app registration. You can't change it after you connect. | | Client Id | Client secret or certificate only. The **Application (client) ID** of your app registration. | | Client Secret | Client secret only. The secret value. | | Client Certificate | Client certificate only. The base64-encoded PEM file with the certificate and its private key. | | I authorize Oleria to perform write actions in Microsoft Fabric (recommended) | Selected by default. Clear it if you don't want Oleria to revoke access. While it's cleared, Oleria refuses revoke actions, but it can still revert earlier ones. You can change it later in the connection settings. | **3. Authenticate** Select **Authenticate**. With OAuth, Microsoft asks an administrator to grant consent, then returns you to Oleria. Before it saves the connection, Oleria checks that it can read users from Microsoft Graph, capacities from the Power BI admin API, and domains from the Fabric admin API. ## Verify the integration Confirm that the connection appears on the **Connected** tab of the **Integrations** page with a status of **Healthy**. After the first sync, review users, non-human identities, groups, and workspaces in your Oleria workspace. The integration's **Capabilities and operation readiness** section lists the permissions each capability needs. If the first sync fails, check that both tenant settings in [Give the app access to the Fabric APIs](#give-the-app-access-to-the-fabric-apis) include the security group. ## Remediation actions Oleria offers **Revoke permission to resource instance** for workspaces and domains when **I authorize Oleria to perform write actions in Microsoft Fabric** is selected. Each target needs the optional setup in [Give the app access to the Fabric APIs](#give-the-app-access-to-the-fabric-apis). | Target | What Oleria does | Revert | | :- | :- | :- | | Workspace | Removes the role (Admin, Member, Contributor, or Viewer) that a user, group, or service principal holds directly on the workspace. Needs the app to be an Admin of that workspace, directly or through a group it belongs to. | Adds the same role back. If the principal holds a different role by then, the revert fails and changes nothing. | | Domain | Removes the domain admin and contributor roles that a user, group, or service principal holds on the domain. | Adds the removed roles back. If the principal has been given a domain role that the revoke didn't remove, the revert fails and changes nothing. | Oleria refuses to revoke: * Access to a capacity or to a single item. * Access of the **Entire organization** group. Remove the organization-wide sharing in Fabric instead. * The app's own role on a workspace or domain. * The last Admin of a workspace. Fabric doesn't allow it. * A group that is the app's only path to Admin on the workspace, because Oleria couldn't revert the change. * Workspace access that an account has only through a group. Oleria gives the group's object ID and role. Remove the account from the group, or remove the group's role in Fabric. * Workspace access where the app isn't an Admin. Oleria gives the workspace ID, so you can add the app as Admin there. > [!NOTE] > > In Fabric, a removed workspace role takes effect the next time the user signs in to Microsoft Fabric. ## Known limitations * **Commercial cloud only.** Fabric and Power BI tenants in the US Government and China clouds can't be connected. * **Personal workspaces aren't collected.** Oleria reads active shared workspaces and their items. **My workspace**, inactive workspaces, and inactive capacities aren't collected. * **Last activity is the last Microsoft Entra sign-in**, not the last use of Fabric. It needs `AuditLog.Read.All` and Microsoft Entra ID P1 or P2. * **Activity looks back up to 28 days** on the first sync. After that, Oleria reads new events with a one-hour delay. * **Classic workspaces** don't show their users, because the Fabric scan doesn't return them. * **Groups with hidden membership** appear without members. Reading them needs `Member.Read.Hidden`, which Oleria doesn't request. * **Eligible role assignments aren't shown.** Oleria reads active assignments of the Global, Fabric, and Power Platform Administrator roles across the whole directory, not Privileged Identity Management (PIM) eligibilities. * **Not synced:** Fabric and Power BI licenses, gateway and connection roles, deployment pipeline roles, and OneLake data access roles. * **Disabling non-human identities** isn't offered from this integration. ## Troubleshooting When Oleria can't connect, it shows **Error creating integration**, followed by `received invalid inputs. actual error:` and one of these messages: | Message | Fix | | :- | :- | | `Microsoft Graph refused the app (status ): grant the application permission User.Read.All with admin consent` | Add the `User.Read.All` application permission and select **Grant admin consent for** your tenant. | | `Microsoft Fabric refused the app (status ): enable the tenant setting "Service principals can access read-only admin APIs" for a security group that contains the app's service principal, and remove any Power BI Service permissions from the app registration` | Add the app to the security group and enable the tenant setting for that group. With your own app, also remove any Power BI Service permissions that require admin consent. Wait up to 15 minutes, then select **Authenticate** again. | | `Microsoft Fabric refused the app's admin API call (status ): enable the tenant settings "Service principals can call Fabric public APIs" and "Service principals can access read-only admin APIs" for a security group that contains the app's service principal` | Enable both tenant settings for a security group that contains the app's service principal (see **Allow the group to use the Fabric APIs** under [Give the app access to the Fabric APIs](#give-the-app-access-to-the-fabric-apis)). Wait up to 15 minutes, then select **Authenticate** again. | | `a valid Directory (tenant) ID is required` | Enter the **Directory (tenant) ID** from your app registration's **Overview** page. | ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.