# Power BI (Cloud)

This article outlines the integration with the Power BI Cloud connector, enabling efficient data management through features such as crawling, report preview, and lineage building (both automatic and manual). It also ensures secure authentication via Credential Manager.

Power BI Cloud connector supports the following authentication types:

* **Service User (Username and Password) Authentication**\
  Service User Authentication uses a **Power BI user account**. Access to workspaces, reports, and datasets is based on the permissions assigned to the service user.
* **Service Principal Authentication**\
  Service Principal Authentication uses an **Azure Entra ID application**. Access is based on the Azure AD app configuration and workspace role assignment. It is configured to call **read-only admin APIs**, the Azure AD application must not have any **admin-consent required Power BI permissions** configured in the Azure portal.

<figure><img src="/files/ophxxYt2ue7XONKYzyLX" alt=""><figcaption></figcaption></figure>

## **Overview**

### **Connector Details**

| Connector Category                                                             | Report System          |
| ------------------------------------------------------------------------------ | ---------------------- |
| OvalEdge Release Supported                                                     | Release6.3.x and later |
| <p>Connectivity</p><p><em>\[How OvalEdge connects to Power BI Cloud ]</em></p> | REST APIs              |
| Power BI Cloud Versions                                                        | Cloud Version          |

### **Connector Features**

| Feature                                                                                                                          | Availability |
| -------------------------------------------------------------------------------------------------------------------------------- | :----------: |
| Crawling                                                                                                                         |       ✅      |
| Delta Crawling                                                                                                                   |       ✅      |
| Profiling                                                                                                                        |       ❌      |
| Query Sheet                                                                                                                      |       ❌      |
| Report Preview                                                                                                                   |       ✅      |
| Auto Lineage                                                                                                                     |       ✅      |
| Manual Lineage                                                                                                                   |       ✅      |
| Secure Authentication via Credential Manager                                                                                     |       ✅      |
| Data Quality                                                                                                                     |       ❌      |
| DAM (Data Access Management)                                                                                                     |       ❌      |
| Bridge                                                                                                                           |       ✅      |
| [Chrome Extension Supported](https://docs.ovaledge.com/home/browser-extension/features-and-operations#view-certification-status) |       ✅      |

### Metadata Mapping

The metadata objects that can be extracted from Power BI Cloud using REST APIs include tenant, workspace, report, page, and semantic model metadata. For more details, click [here](https://docs.ovaledge.com/release8.1/connectors/connector-repositories/reporting-tool/power-bi/power-bi-cloud/power-bi-rest-apis-metadata).

The following objects are crawled from Power BI Cloud and mapped to the corresponding UI assets.

<table><thead><tr><th width="162.63641357421875">Source Object</th><th>Source Attribute</th><th>OvalEdge Attribute</th><th>OvaEdge Category</th><th>OvalEdge Type</th></tr></thead><tbody><tr><td>Workspaces</td><td>Workspace</td><td>Report Group</td><td>Reports</td><td>Workspaces</td></tr><tr><td>Workspaces</td><td>Workspace description</td><td>source description</td><td>description</td><td>Workspaces</td></tr><tr><td>Reports</td><td>Reports Name</td><td>Report Name</td><td>Reports</td><td>Reports</td></tr><tr><td>Reports</td><td>Report description</td><td>source description</td><td>description</td><td>Reports</td></tr><tr><td>Reports</td><td>Report Type</td><td>type</td><td>Reprots</td><td>Dashboard, Report, Tile, Paginated report</td></tr><tr><td>Reports</td><td>webUrl</td><td>contentUrl</td><td>Reports</td><td>Reports</td></tr><tr><td>Pages</td><td>Page Name</td><td>Report Name</td><td>Reports</td><td>Page</td></tr><tr><td>Pages</td><td>Page description</td><td>source description</td><td>Reports</td><td>Page</td></tr><tr><td>Pages</td><td>Page type</td><td>type</td><td>Reports</td><td>Page</td></tr><tr><td>Dataset/Semantic Model</td><td>Dataset Name</td><td>Dataset Name</td><td>Reports</td><td>Dataset, Dataflow</td></tr><tr><td>Dataset/Semantic Model</td><td>Dataset Description</td><td>source description</td><td>description</td><td>Dataset, Dataflow</td></tr><tr><td>Dataset/Semantic Model</td><td>Dataset Type</td><td>type</td><td>Reports</td><td>Dataset, Dataflow</td></tr><tr><td>Datset/Semantic Model Tables</td><td>Table Name</td><td>Table name</td><td>Table</td><td></td></tr><tr><td>Datset/Semantic Model Tables</td><td>Description</td><td>source description</td><td></td><td></td></tr><tr><td>Datset/Semantic Model Table Fields</td><td>Field Name</td><td>Column name</td><td>Column</td><td>Measure, TField</td></tr><tr><td>Datset/Semantic Model Table Fields</td><td>Description</td><td>source description</td><td>Column</td><td>Measure, TField</td></tr><tr><td>Datset/Semantic Model Table Fields</td><td>Field Type</td><td>type</td><td>Column</td><td>Measure, TField</td></tr><tr><td>Datset/Semantic Model Table Fields</td><td>Expression</td><td>Formula</td><td>Column</td><td>Measure, TField</td></tr></tbody></table>

The following metadata information can be extracted only from the PBIX file:

| Source Object | Source Attribute  | OvalEdge Attribute | OvaEdge Category | OvalEdge Type              |
| ------------- | ----------------- | ------------------ | ---------------- | -------------------------- |
| Visual        | Visual Name       | Report Name        | Reports          | Visual                     |
| Visual        | Visual type       | type               | Reports          | Bar chart, pie chart etc.. |
| Visual Fields | Visual Field Name | Column name        | Report Field     | Measure, TField            |
| Visual Fields | Description       | source description | Report Field     | Measure, TField            |
| Visual Fields | Visual Field Type | type               | Report Field     | Measure, TField            |
| Visual Fields | Expression        | Formula            | Report Field     | Measure, TField            |

## Set up a Connection

### Prerequisites

The following are the prerequisites to establish a connection:

For detailed prerequisite configuration steps in **Azure** and **Power BI** (including **App Registration**, **Security Group creation**, and **Power BI Admin Portal settings**), refer to the [**Power BI Cloud System Configuration**](https://docs.ovaledge.com/release8.1/connectors/connector-repositories/reporting-tool/power-bi/power-bi-cloud/power-bi-cloud-system-configuration)**.**

For the minimum required **Azure DevOps Personal Access Token (PAT)** permissions, repository access requirements, and **PAT configuration** steps required for **PBIP** metadata extraction, refer to the [**Azure DevOps PAT Permissions for PBIP Extraction**](https://docs.ovaledge.com/release8.1/connectors/connector-repositories/reporting-tool/power-bi/power-bi-cloud/azure-devops-pat-permissions-for-pbip-extraction).

#### **Service Account User Permissions**

{% hint style="warning" %}
It is recommended to use a separate service account to establish the connection to the data source, configured with the following minimum set of permissions.
{% endhint %}

{% hint style="info" %}
👨‍💻Who can provide these permissions? These permissions are typically granted by the Power BI Cloud administrator, as users may not have the required access to assign them independently.
{% endhint %}

<table><thead><tr><th width="219.8333740234375">Objects</th><th>Access Permission</th></tr></thead><tbody><tr><td>Connector Validation</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Crawling</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Lineage</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Delta Crawl</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Semantic Model / Dataset</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Report</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Pages</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr><tr><td>Visuals</td><td>Service Principal with Admin API Access or Service User with Admin rights</td></tr></tbody></table>

#### Service Principal

**Grant Access to Power Workspace**

When Service Principal authentication is used, the service principal must be added to the Power BI workspace with one of the following roles:

* Admin
* Member

{% hint style="info" %}
For Service Principal authentication, API-level administrative permissions alone are insufficient. Viewer and Contributor workspace roles do not support PBIX export operations.
{% endhint %}

**OAuth-Based Authentication Using Service Principal**

Service Principal authentication in OvalEdge uses the Microsoft-recommended **OAuth 2.0** framework secured by **Microsoft Entra ID (Azure Active Directory)** to access Power BI REST APIs.

Power BI REST APIs are protected by Microsoft Entra ID and require OAuth authentication for application integrations. OvalEdge supports this through Service Principal authentication, which is Microsoft’s standard non-interactive authentication approach for system integrations.

At a high level, the authentication process works as follows:

* An application is registered in Microsoft Entra ID (Azure AD).
* Required Power BI API permissions are configured for the application.
* An OAuth 2.0 access token is generated.
* Power BI REST API calls are executed using the generated secure access token.

This method does not require storage of user credentials and aligns with enterprise security standards for automated integrations.

{% hint style="warning" %}
OAuth token generation is handled internally by OvalEdge. Users only need to provide the Azure application details during connection configuration.
{% endhint %}

#### Service User Configuration

**Grant Access to Power Workspace**

When **Service User (Username and Password) authentication** is used, the service user must be added to the Power BI workspace with one of the following roles:

* **Contributor**
* **Viewer**

{% hint style="info" %}
Access to workspaces, reports, and datasets is based on the permissions assigned to the service user in Power BI.
{% endhint %}

#### Azure DevOps (PBIP)

* Personal Access Token (PAT) must have access to the target project repositories.
* Organization and Project ID must match the Azure DevOps project.
* Ensure required access permissions are available for repository read operations.

{% hint style="info" %}
When Azure DevOps (PBIP) is selected, the system retrieves report metadata during crawl and generates report, page, and visual details. Review crawl logs for success or warnings. If duplicate report names exist across repositories, selection may require log review. Ensure the file path is valid and accessible.
{% endhint %}

### Connection Configuration Steps

{% hint style="info" %}
Users are required to have the Connector Creator role in order to configure a new connection.
{% endhint %}

1. Log into **OvalEdge**, go to **Administration > Connectors**, click **+ (New Connector)**, search for **Power BI**, and complete the required parameters.

{% hint style="info" %}
Fields marked with an asterisk (\*) are mandatory for establishing a connection.
{% endhint %}

<table><thead><tr><th width="219.00006103515625">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Connector Type</td><td>By default, "PowerBI Cloud" is displayed as the selected connector type.</td></tr><tr><td>Server Type*</td><td>From the dropdown list options (powerbionpremise/powerbicloud), select <strong>powerbicloud</strong>.</td></tr><tr><td>Authentication*</td><td><p>Power BI Cloud supports two types of authentication.</p><ul><li>Username and Password (Service User)</li><li>Service Principal</li></ul><p><strong>Note</strong>: Service User authentication requires a Power BI user account, while Service Principal authentication requires an Azure Entra ID application with Azure AD app configuration and workspace role assignment. An app using service principal authentication that calls read-only admin APIs must not have any admin-consent required permissions for Power BI set on it in the Azure portal.</p></td></tr></tbody></table>

{% tabs %}
{% tab title="Username and Password (Service User)" %}

<table><thead><tr><th width="214.83331298828125">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Credential Manager*</td><td><p>Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on your selection.</p><p>Supported Credential Managers:</p><ul><li>OE Credential Manager</li><li>AWS Secrets Manager</li><li>HashiCorp</li><li>Azure Key Vault</li></ul></td></tr><tr><td>License Add Ons</td><td>Select the checkbox for Auto Lineage Add-On to build data lineage automatically.</td></tr><tr><td>PBIX/PBIT/PBIP Source*</td><td><p>Enter the PBIX/PBIT/PBIP Source. Select an option from the drop-down.</p><ul><li>Local Drive</li><li>One Drive</li><li>Azure DevOps PBIP</li></ul></td></tr><tr><td>Connector Name*</td><td><p>Enter a unique name for the Power BI Cloud connection              </p><p>(Example: "PowerBICloud").</p></td></tr><tr><td>Connector Environment</td><td>Select the environment (Example: PROD, STG) configured for the connector.</td></tr><tr><td>Connector Description</td><td>Enter a brief description of the connector.</td></tr><tr><td>One Drive Connection*</td><td><p>Provide the OneDrive connector ID.</p><p><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as OneDrive.</em></p></td></tr><tr><td>OneDrive Folder Name</td><td><p>Provide the OneDrive folder Name.</p><p><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as OneDrive.</em></p></td></tr><tr><td>Organization*</td><td>Enter the Azure DevOps organization name associated with the target project.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Project Id*</td><td>Enter the Project ID corresponding to the Azure DevOps project from which PBIP metadata will be retrieved.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Personal Access Token*</td><td>Enter a valid Personal Access Token (PAT) with access to the target project repositories to enable authentication and metadata extraction.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Extended Validation (Yes/No)</td><td>Enable or disable extended validation for the selected Local Drive source. Enter <strong>Yes</strong> to perform additional validation checks during processing, or <strong>No</strong> to proceed with standard validation only.</td></tr><tr><td>Client Id*</td><td>A unique identifier generated during app registration in Azure AD is used to authenticate the app in Power BI.</td></tr><tr><td>Client Secret*</td><td>A confidential key is generated during app registration and used to authenticate the app securely.</td></tr><tr><td>Tenant</td><td>An organization that owns and manages the Microsoft cloud instance (e.g., organization.onmicrosoft.com)</td></tr><tr><td>Tenant Id*</td><td>A unique identifier for the Azure AD instance is used to authenticate the app within the tenant.</td></tr><tr><td>Username*</td><td>Enter the service account username set up to access the Power BI Cloud (Example: "oesauser").</td></tr><tr><td>Password*</td><td>Enter the password associated with the service account user (Example: "password").</td></tr><tr><td>Files Path*</td><td>Provide the server file path to temporarily store exported PBIX files.</td></tr><tr><td>Premium reports(Y/N)</td><td>Select the Premium Report option. When the option is Yes, the user can crawl the report's dataset, and when the premium option is selected as NO, the user can only view the report.</td></tr><tr><td>Okta Enabled(Y/N)</td><td>If Okta is enabled for the given service user, enter ‘Y’; otherwise, enter ‘N’.</td></tr><tr><td>Read From NFS(Y/N)</td><td>To retrieve reports directly from the folder without connecting to the Power BI service, enter 'Y'; otherwise, enter 'N’.</td></tr><tr><td>Crawl Hidden Pages(Y/N)</td><td>To crawl the hidden pages, enter ‘Y’; otherwise, enter 'N’.</td></tr><tr><td>Plugin Open In PowerBI Apps(Y/N)</td><td><p>To open the reports using Apps in Power BI, enter ‘Y’. Else enter ‘N’.</p><p><strong>Note</strong>: Reports will open via apps if available; otherwise, they'll open through workspaces.</p></td></tr><tr><td>Exclude Auto-Generated Reports(Yes/No)</td><td>Enable or disable exclusion of system-generated reports. Enter <strong>Yes</strong> to skip auto-generated reports during processing, or <strong>No</strong> to include them.</td></tr><tr><td>Proxy Enabled*</td><td>Select Yes to route API calls through a proxy server. Select No to bypass the proxy and connect directly.</td></tr></tbody></table>
{% endtab %}

{% tab title="Service Principal" %}

<table><thead><tr><th width="214.83331298828125">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Credential Manager*</td><td><p>Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on your selection.</p><p>Supported Credential Managers:</p><ul><li>OE Credential Manager</li><li>AWS Secrets Manager</li><li>HashiCorp</li><li>Azure Key Vault</li></ul></td></tr><tr><td>License Add Ons</td><td>Select the checkbox for Auto Lineage Add-On to build data lineage automatically.</td></tr><tr><td>PBIX/PBIT/PBIP Source*</td><td><p>Enter the PBIX/PBIT/PBIP Source. Select an option from the drop-down.</p><ul><li>Local Drive</li><li>One Drive</li><li>Azure DevOps PBIP</li></ul></td></tr><tr><td>Connector Name*</td><td><p>Enter a unique name for the Power BI Cloud connection              </p><p>(Example: "PowerBICloud").</p></td></tr><tr><td>Connector Environment</td><td>Select the environment (Example: PROD, STG) configured for the connector.</td></tr><tr><td>Connector Description</td><td>Enter a brief description of the connector.</td></tr><tr><td>One Drive Connection*</td><td><p>Provide the OneDrive connector ID.</p><p><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as OneDrive.</em></p></td></tr><tr><td>OneDrive Folder Name</td><td><p>Provide the OneDrive folder Name.</p><p><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as OneDrive.</em></p></td></tr><tr><td>Organization*</td><td>Enter the Azure DevOps organization name associated with the target project.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Project Id*</td><td>Enter the Project ID corresponding to the Azure DevOps project from which PBIP metadata will be retrieved.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Personal Access Token*</td><td>Enter a valid PAT with access to the target project repositories to enable authentication and metadata extraction.<br><em><strong>Note</strong>: This field gets populated if the PBIX/PBIT/PBIP Source is selected as Azure DevOps PBIP.</em></td></tr><tr><td>Extended Validation (Yes/No)</td><td>Enable or disable extended validation for the selected Local Drive source. Enter <strong>Yes</strong> to perform additional validation checks during processing, or <strong>No</strong> to proceed with standard validation only.</td></tr><tr><td>Client Id*</td><td>A unique identifier generated during app registration in Azure AD is used to authenticate the app in Power BI.</td></tr><tr><td>Client Secret*</td><td>A confidential key is generated during app registration and used to authenticate the app securely.</td></tr><tr><td>Tenant</td><td>An organization that owns and manages the Microsoft cloud instance (e.g., organization.onmicrosoft.com)</td></tr><tr><td>Tenant Id*</td><td>A unique identifier for the Azure AD instance is used to authenticate the app within the tenant.</td></tr><tr><td>Files Path*</td><td>Provide the server file path to temporarily store exported PBIX files.</td></tr><tr><td>Premium reports(Y/N)</td><td>Select the Premium Report option. When the option is Yes, the user can crawl the report's dataset, and when the premium option is selected as NO, the user can only view the report.</td></tr><tr><td>Okta Enabled(Y/N)</td><td>If Okta is enabled for the given service user, enter ‘Y’; otherwise, enter ‘N’.</td></tr><tr><td>Read From NFS(Y/N)</td><td>To retrieve reports directly from the folder without connecting to the Power BI service, enter 'Y'; otherwise, enter 'N’.</td></tr><tr><td>Crawl Hidden Pages(Y/N)</td><td>To crawl the hidden pages, enter ‘Y’; otherwise, enter 'N’.</td></tr><tr><td>Plugin Open In PowerBI Apps(Y/N)</td><td><p>To open the reports using Apps in Power BI, enter ‘Y’. Else enter ‘N’.</p><p><strong>Note</strong>: Reports will open via apps if available; otherwise, they'll open through workspaces.</p></td></tr><tr><td>Exclude Auto-Generated Reports(Yes/No)</td><td>Enable or disable exclusion of system-generated reports. Enter <strong>Yes</strong> to skip auto-generated reports during processing, or <strong>No</strong> to include them.</td></tr><tr><td>Proxy Enabled*</td><td>Select Yes to route API calls through a proxy server. Select No to bypass the proxy and connect directly.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

**Default Governance Roles**

<table data-header-hidden><thead><tr><th width="220.66668701171875"></th><th></th></tr></thead><tbody><tr><td>Default Governance Roles*</td><td>Select the appropriate users or teams for each governance role from the drop-down list. All users configured in the security settings are available for selection.</td></tr></tbody></table>

**Admin Roles**

<table data-header-hidden><thead><tr><th width="219.83331298828125"></th><th></th></tr></thead><tbody><tr><td>Admin Roles*</td><td>Select one or more users from the drop-down list for Integration Admin and Security &#x26; Governance Admin. All users configured in the security settings are available for selection.</td></tr></tbody></table>

**No of Archive Objects**

<table data-header-hidden><thead><tr><th width="220.66668701171875"></th><th></th></tr></thead><tbody><tr><td>No Of Archive Objects*</td><td><p>This shows the number of recent metadata changes to a dataset at the source. By default, it is off. To enable it, toggle the Archive button and specify the number of objects to archive.</p><p>Example: Setting it to 4 retrieves the last four changes, displayed in the 'Version' column of the 'Metadata Changes' module.</p></td></tr></tbody></table>

**Bridge**

<table data-header-hidden><thead><tr><th width="220.666748046875"></th><th></th></tr></thead><tbody><tr><td>Select Bridge*</td><td><p>If applicable, select the bridge from the drop-down list.</p><p>The drop-down list displays all active bridges that have been configured. These bridges facilitate communication between data sources and the system without requiring changes to firewall rules.</p></td></tr></tbody></table>

2. After entering all connection details, the following actions can be performed:
   1. Click **Validate** to verify the connection.
   2. Click **Save** to store the connection for future use.
   3. Click **Save & Configure** to apply additional settings before saving.
3. The saved connection will appear on the Connectors home page.

## Manage Connector Operations

### Crawl

{% hint style="warning" %}
To perform crawl operations, users must be assigned the Integration Admin role.
{% endhint %}

The **Crawl/Profile** button allows users to select one or more **schemas** for crawling.&#x20;

1. Navigate to the **Connectors** page and click **Crawl/Profile**.
2. Select the schemas to be crawled.
3. The Crawl option is selected by default.
4. Click **Run** to collect metadata from the connected source and load it into the **Data Catalog**.
5. After a successful crawl, the information appears in the **Data Catalog > Report / Report Column** tab.

The Schedule checkbox allows automated crawling and profiling at defined intervals, from a minute to a year.

1. Click the **Schedule** checkbox to enable the **Select Period drop-down**.
2. Select a time period for the operation from the drop-down menu.
3. Click **Schedule** to initiate metadata collection from the connected source.
4. The system will automatically execute the **crawl** operation at the scheduled time.

#### **Other Operations**

The Connectors page provides a centralized view of all configured connectors, along with their health status.

**Managing connectors includes:**

* **Connector Health**: Displays the current status of each connector using a **green** icon for active connections and a **red** icon for inactive connections, helping to monitor the connectivity with data sources.
* **Viewing**: Click the **Eye icon** next to the connector name to view connector details, including databases, tables, columns, and codes.

**Nine Dots Menu Options:**

To view, edit, validate, build lineage, configure, or delete connectors, click on the **Nine Dots menu**.

* **Edit Connector:** Update and revalidate the data source.
* **Validate Connector**: Check the connection's integrity.
* **Settings**: Modify connector settings.
  * **Crawler**: Configure data extraction.
  * **Access Instructions:** Add notes on how data can be accessed.
  * **Business Glossary Settings**: Manage term associations at the connector level.
  * **Lineage**: Configure Server Dialects for source code parsing and Connector Priority for table lineage connection.
  * **Others**: Configure notification recipients for metadata changes.
* **Build Lineage**: Automatically build data lineage using source code parsing.
* **Delete Connector**: Remove a connector with confirmation.

## Limitations

### Power BI Embedded – Embed Token Limitations

<table><thead><tr><th width="90.33334350585938">Sl. No.</th><th width="218.66668701171875">Scenario</th><th>Limitation</th></tr></thead><tbody><tr><td>1</td><td><strong>Dedicated Capacity (A, EM, P SKU)</strong></td><td>No published limit on the number of embed tokens that can be generated. Embed token usage can be monitored using the <strong>“Available Features” API</strong>.</td></tr><tr><td>2</td><td><strong>Shared Capacity / Pro / PPU Licensing</strong></td><td>Embed token generation is limited (not published) and intended only for development/testing. Users may receive the error: <strong>“You have exceeded the amount of embed token that can be generated on a shared or ProPlus capacity.”</strong></td></tr><tr><td>3</td><td><strong>Shared Capacity / Pro / PPU Licensing</strong></td><td>Microsoft states embed tokens generated under Pro/PPU are meant only for development testing. To avoid limitations, dedicated capacity (A/EM/P SKU) is required for production embedding.</td></tr><tr><td>4</td><td><strong>Embed Token Lifetime</strong></td><td>Embed tokens expire automatically. The token lifetime is tied to the Microsoft Entra ID access token used during token generation and is typically valid for approximately one hour. The expiration duration cannot be extended.</td></tr><tr><td>5</td><td><strong>My Workspace Limitation</strong></td><td>Embed tokens cannot be generated for reports or content stored in <strong>My Workspace</strong>. Reports must be located in a Power BI Workspace (App Workspace).</td></tr><tr><td>6</td><td><strong>Workspace Permission Requirement</strong></td><td>The configured Service Principal or Service User must be a member of the workspace containing the report and semantic model. If reports and semantic models exist in different workspaces, access permissions are required for all associated workspaces.</td></tr><tr><td>7</td><td><strong>Workspace Capacity Requirement</strong></td><td>For production embedding scenarios, the workspace must be assigned to Power BI Embedded or Premium capacity. Without dedicated capacity, embedding capabilities are intended only for development and testing purposes.</td></tr><tr><td>8</td><td><strong>Token Scope Limitation</strong></td><td>Embed tokens are generated only for supported artifacts such as reports, semantic models, and dashboards. Some APIs do not support generating a single embed token for multiple dashboards or tiles simultaneously.</td></tr></tbody></table>

### Power BI REST API – PBIX Export Limitations

<table><thead><tr><th width="90.33331298828125">Sl. No.</th><th width="216.6666259765625">Limitation Type</th><th>Limitation</th></tr></thead><tbody><tr><td>1</td><td><strong>Report Type Limitation</strong></td><td>Reports created directly in <strong>Power BI Service (online editing)</strong> cannot be exported as <strong>.pbix</strong> using REST API.</td></tr><tr><td>2</td><td><strong>Report Type Limitation</strong></td><td>Reports using <strong>Live Connection / DirectQuery to another dataset</strong> do not support PBIX export.</td></tr><tr><td>3</td><td><strong>Report Type Limitation</strong></td><td>Reports using <strong>Dataflows, Analysis Services live connection, or composite models</strong> cannot be exported using REST API.</td></tr><tr><td>4</td><td><strong>File Size Limitation</strong></td><td>Exporting large PBIX files (greater than <strong>1 GB uncompressed</strong>) may fail or time out. Microsoft does not officially guarantee export success beyond approximately <strong>500 MB</strong>.</td></tr><tr><td>5</td><td><strong>Download Permission Requirement</strong></td><td>PBIX export operations require the <strong>Download .pbix</strong> option to be enabled in the workspace or report settings. If the tenant administrator disables PBIX downloads, the REST API export operation fails.</td></tr><tr><td>6</td><td><strong>Sensitivity Label Limitation</strong></td><td>Reports configured with Microsoft Information Protection (MIP) sensitivity labels may restrict or block PBIX export operations depending on tenant-level security configurations.</td></tr><tr><td>7</td><td><strong>Composite Model Limitation</strong></td><td>Some complex composite models, particularly models referencing external semantic models, may not support PBIX export operations through REST APIs.</td></tr><tr><td>8</td><td><strong>Workspace Permission Requirement</strong></td><td>To export PBIX files through REST APIs, the configured Service Principal or Service User must have one of the following workspace roles: Admin, Member, or Contributor. Viewer access does not support PBIX export operations.</td></tr><tr><td>9</td><td><strong>Export Scope Limitation</strong></td><td>REST API export operations support report export only. Export operations are not supported for dashboards, individual visuals, or semantic models independently.</td></tr></tbody></table>

### Power BI Azure DevOps PBIP – Extraction Limitations

<table><thead><tr><th width="91.72723388671875">Sl. No.</th><th width="216.18182373046875">Limitation Type</th><th>Limitation</th></tr></thead><tbody><tr><td>1</td><td>Project Scope Limitation</td><td>Currently supports processing for a single project within a connection. Support for multiple projects within the same connection is not available.</td></tr><tr><td>2</td><td>Duplicate Report Name Limitation</td><td>Due to ambiguity in identifying reports with identical names across multiple repositories, such reports are skipped during PBIP extraction. This avoids incorrect metadata mapping and may require manual review using crawl logs.</td></tr></tbody></table>

## FAQs

<details>

<summary>What is the impact of renaming a Power BI workspace on curated metadata?</summary>

Renaming a Power BI workspace does **not** inactivate or delete curated metadata in OvalEdge.

* The workspace name is updated after re-crawl
* The external reference ID remains unchanged
* Existing objects remain active
* Curated metadata (tags, descriptions, glossary terms, etc.) is retained.

**Recommendation:**\
It is safe to rename workspaces at the source. However, it is recommended to validate the change in a development or test environment before applying it in production.

</details>

***

Copyright © 2025, OvalEdge LLC, Peachtree Corners GA USA


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.ovaledge.com/release8.1/connectors/connector-repositories/reporting-tool/power-bi/power-bi-cloud.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.