Set up Azure for Power BI Lineage Collection

IMPORTANT:

  • For Azure configuration with Log Analytics:
    • Configuring Log Analytics requires the following permissions:
    • Authentication user must be a Fabric Administrator, or Service Principal authentication must be used.
    • To assign a role that grants access to the Log Analytics Workspace, the user must have at least the Application Administrator role.
      • This is required to configure the Azure App.
  • For Azure configuration without Log Analytics:

NOTE: We recommend configuring Log Analytics for Lineage to improve the precision of Lineage metadata collection. With Log Analytics enabled, Lineage returns more accurate data on columns and tables from which the Reports are derived. In case Log Analytics is disabled, the metadata returned from the Power BI available in Lineage may contain duplicates, such as extra tables and columns.

This article is intended for Azure administrators who set up the corresponding resources in Azure Portal for Power BI Lineage collection. Additional authentication-specific Azure setup steps are described in the prerequisite articles referenced below.

The process includes the following steps:

  1. Configure the Azure resources based on whether Log Analytics will be used for Lineage collection.
    • With Log Analytics: Enable Log Analytics integration in both Azure and the Power BI Admin Portal, configure Azure application, grant the Tenant.Read.All permission.
    • Without Log Analytics: Grant Azure application the Tenant.Read.All permission.
  2. Share Azure application details required for the selected Power BI authentication method with your organization's Metric Insights administrator.
    • Metric Insights administrator will use these details to configure Power BI Data Source in Metric Insights and complete Lineage collection.

NOTE: The easiest and cheapest way to get logs into a Workspace in Azure is to allow a Service Principal to have access to the Power BI Workspaces that must stream their logs into the Log Analytics Workspace. The other, more expensive way is to allow Power BI Workspaces to stream their logs into the Log Analytics Workspace in Azure.

PREREQUISITES:

  1. Ensure Prerequisites for Connecting to Microsoft Power BI Cloud are met for your selected Power BI authentication type.
  2. The Azure application configured for the selected authentication type is the same Azure application used in this article.

TABLE OF CONTENTS:

  1. Enable Log Analytics Integration in Azure and Power BI
    1. Check Log Export
  2. Copy Log Analytics Workspace ID from Azure
  3. Configure Azure App
  4. Grant Tenant.Read.All Permission
  5. Copy and Share Azure App Credentials with Metric Insights Administrator

After completing the setup described in the PREREQUISITES section, proceed with the configuration steps in this article based on whether Log Analytics will be used for Lineage collection:

  • Azure configuration with Log Analytics:
    • Complete all steps of this article.
  • Azure configuration without Log Analytics:
    • Proceed to Step 4 (Grant Tenant.Read.All permission) and then to Step 5.

1. Enable Log Analytics Integration in Azure and Power BI

NOTE: Log Analytics Workspace is not a Power BI workspace and needs to be created separately, as described in the Microsoft documentation referenced below.

Follow Microsoft’s official guidance to configure Log Analytics for use with Power BI.

To complete the setup described in the Microsoft article, you will:

Once done, logs will begin streaming to Azure, and you can confirm this by querying tables such as PowerBIDatasetsWorkspace in the Azure portal.

1.1. Check Log Export

Access Azure portal > Log Analytics workspace > Logs

If configured correctly, Log Analytics from Power BI activity logs are displayed.

2. Copy Log Analytics Workspace ID from Azure

Access Log Analytics workspace > Overview tab

  1. Copy the Workspace ID value.

3. Configure Azure App

Set up authentication as described in the Microsoft documentation. The required steps are:

  • Configure Azure app:
    1. Access the Azure application you have configured according to the PREREQUISITES section of this article.
    2. Access API permissions > [+ Add a permission] > APIs my organization uses > Log Analytics API > Delegated permissions > Data.Read
    3. [Add permissions]
  • Grant app access to the Log Analytics workspace:
    1. Log Analytics Workspace > Access control (IAM) > [Add role assignment]  
    2. Select the Reader role.
    3. Access Members > [+ Select members] > Enter the name of your app in the Select box > Select > [Review + assign]

NOTE: To assign a role that grants access to the Log Analytics Workspace, the user must have at least the Application Administrator role.

  • Assign this role via Azure Portal > User > Select a User  > Assigned roles > [+ Add assignments] > Application Administrator

4. Grant Tenant.Read.All Permission

NOTE: See Why BI Optimizer Requires Tenant.Read.All Permission?

  • For Azure configuration with Log Analytics: Access the Azure application configured in the previous step.
  • For Azure configuration without Log Analytics: Access the Azure application configured according to the PREREQUISITES section of this article.

NOTE: Credentials of this Azure application will be used for the Data Source connection in Metric Insights.

  1. Under Manage, click on API Permissions.
  2. [ + Add a permission]
  3. Scroll to and select Power BI Service.
  4. Click on Delegated permissions.
  5. Under "Tenant", find and check Tenant.Read.All
  6. [Add permissions]

5. Copy and Share Azure App Credentials with Metric Insights Administrator

Once you have finished the Azure app configuration, access this app's Overview tab.

Depending on the selected Power BI authentication method for the MI Data Source, you may need to share the following credentials with your organization's MI admin:

  • Service Principal:
    • Application (client) ID: For Application ID of the MI Data Source.
    • Directory (tenant) ID: For Directory (tenant) Id of the MI Data Source.
    • Client Secret Value: For Client Secret of the MI Data Source.
      • See Add Client Secret for details on creating a Client Secret and obtaining its value for Service Principal.
  • OAuth:
    • Application (client) ID: For Application ID of the MI Data Source.
    • Directory (tenant) ID: For Directory (tenant) Id of the MI Data Source.
    • If Log Analytics is not used:
      • Client Secret Value: For Client Secret of the MI Data Source.
      • See Add a Client Secret for details on creating a Client Secret and obtaining its value for OAuth.
  • Password:
    • Application (client) ID: For Application ID of the MI Data Source.

NOTE: For OAuth and Password authentication you also need to share Fabric Administrator credentials.