What permissions does MetricSign need for Power BI?
MetricSign connects to Power BI through Microsoft OAuth (PKCE flow) and requests the minimum delegated permissions required to monitor your pipelines. All access is read-only — MetricSign cannot modify datasets, trigger refreshes, or alter any workspace content.
Standard OAuth consent (base flow)
The following scopes are requested when you click "Connect with Microsoft":
| Scope | Purpose |
|---|---|
| Dataset.Read.All | Read dataset metadata and refresh history across all workspaces you have access to |
| Report.Read.All | Read report metadata (used for lineage and asset inventory) |
| Workspace.Read.All | List workspaces the signed-in account is a member of |
| Dataflow.Read.All | Monitor Dataflow refresh status and history |
| App.Read.All | Read Power BI app metadata (dashboards distributed via apps) |
> Why granular scopes instead of .default? MetricSign explicitly requests individual scopes rather than .default to avoid requesting Tenant.Read.All. In enterprise environments where multiple business units share a single Azure AD tenant, Tenant.Read.All is often blocked by IT policy. With granular scopes, MetricSign only sees workspaces the signed-in user is a member of.
Optional: Capacity monitoring (separate consent)
Capacity.Read.All is requested in a separate, optional flow because it requires a Power BI capacity administrator to consent. Users without admin rights can complete the base connection without it — capacity metrics and throttling detection will simply not be available until a capacity admin grants this scope.
ADF monitoring (separate flow)
Monitoring Azure Data Factory requires an additional OAuth consent for https://management.azure.com/user_impersonation. This is prompted separately after the Power BI consent — you can skip it if you do not use ADF.
Service principal option
If your organisation prefers not to use delegated (user) OAuth, MetricSign supports service principal authentication:
- Register an Azure AD app registration in your tenant
- Grant the Power BI service the required API permissions (
Dataset.Read.All,Workspace.Read.All, etc.) with admin consent - Add the service principal to the relevant workspaces or grant tenant-wide Power BI service admin access
- Provide the client ID, client secret, and tenant ID in MetricSign's connector settings
With service principal, the connector uses the .default scope on the Power BI resource — meaning the permissions configured on the app registration in Azure AD are what determines access.
What MetricSign reads
- Refresh timestamps (start time, end time, status) and error messages
- Dataset, report, and workspace names and metadata
- Dataflow refresh status and run history
- Power BI app metadata
What MetricSign never accesses
- Report visuals or dashboard content
- Underlying data values or query results
- User credentials or passwords
- Any data outside the workspaces the signed-in account can reach
Security review checklist
For IT and security teams evaluating MetricSign:
- OAuth tokens are stored encrypted at rest on European AWS infrastructure (eu-west-1)
- OAuth refresh tokens can be revoked at any time from your Microsoft Entra admin centre
- MetricSign operates on metadata only — no data content ever leaves your Microsoft environment
- A Data Processing Agreement (DPA) is available on request
Setup takes approximately 15 minutes through the guided OAuth flow. No agents, SDKs, or firewall changes are required.