Skip to main content
Connect Power BI to Athena so members can browse reports and dashboards, inspect semantic models, and run DAX queries in chat — each acting as their own Microsoft Entra identity. Every call runs as the signed-in member, so Power BI’s own workspace and item permissions decide what they can see. A Viewer stays a Viewer.
Setup is two steps, done by two different people: your Microsoft Entra administrator registers an app, then an Athena workspace admin saves it once for the whole workspace. Members can only connect after both are done.

​
Step 1 — Register an Entra ID application (Entra admin)

  1. Microsoft Entra admin center → App registrations → New registration. Name it something recognizable, e.g. Athena — Power BI.
  2. Supported account types: Accounts in this organizational directory only (single tenant). This is the right choice for almost everyone, and it pairs with a tenant GUID in step 3.
  3. Redirect URI: platform Web, value:
    Entra compares redirect URIs as exact strings — a stray trailing slash or http instead of https fails the handshake.
  4. API permissions → Add a permission → Power BI Service → Delegated permissions, and add all four: Then Grant admin consent for your tenant.
  5. Certificates & secrets → New client secret. Copy the Value immediately; Microsoft only shows it once. Set a reminder to rotate it before it expires.
  6. Overview: copy the Application (client) ID and Directory (tenant) ID.
The permission set is read-write because Athena ships tools that refresh datasets, update parameters, take over datasets, and clone or rebind reports. Consent scope and Power BI item permissions are independent gates — granting ReadWrite does not turn a Viewer into an Editor.
Two features have extra requirements beyond these four permissions. Power BI apps: listing installed apps needs the App.Read.All delegated permission, which is not in the default set — add and consent to it (and have members reconnect) if you want app browsing; workspace reports and dashboards work without it. Report export to file (PDF/PPTX/PNG) is a Power BI capacity feature: the workspace must be on dedicated capacity (Premium/Fabric or PPU), or Power BI rejects the export regardless of permissions.

​
Step 2 — Allow REST API access in the Power BI tenant (Power BI admin)

In the Power BI admin portal → Tenant settings → Developer settings, make sure the relevant API access is enabled for the users or groups who will connect. A tenant that blocks it returns a 403 even though sign-in succeeded. Each connecting member also needs a Power BI licence.

​
Step 3 — Enable Power BI in Athena (workspace admin, once)

An Athena workspace admin or owner must add the app for the entire workspace — individual members cannot do this, and the connect option stays hidden from them until it’s done. Open Workspace Settings → Integrations, expand Power BI (Direct OAuth), click Add app, and fill in: Toggle the app on and Save app. You can register more than one app — for example one per tenant — and members get a dropdown to choose which to authorize against. Secrets are encrypted at rest and never returned to the browser.

​
Step 4 — Members connect (each user)

  1. Go to Integrations and click Power BI (Direct OAuth) → Connect.
  2. Pick the app, if more than one is enabled.
  3. Sign in to Microsoft and consent. Athena always asks you to sign in rather than reusing a cached browser session, so the connection is unambiguously yours.
  4. Confirm the Entra identity shown, then select one or more Power BI workspaces. Each becomes a catalog in Athena. You can connect several, and come back later to add more.

​
What you can do once connected

  • @-mention a report or dashboard in chat to bring it into context.
  • Ask about the data. Athena can list reports, dashboards, and datasets; read a dataset’s tables, columns, measures, and relationships; and run DAX against it to answer questions.
  • Operate on content. Refresh a dataset, check refresh history, update parameters, export a report, or clone and rebind one — all as you, within what Power BI already lets you do.
Tokens are per-user, encrypted at rest, and refreshed automatically. Power BI permissions remain the source of truth — losing access to a workspace in Power BI immediately removes what Athena can do there for that member.

​
Troubleshooting

​
Not supported yet

  • Microsoft Fabric / TMDL semantic model definitions. Dataset schema comes from Power BI’s own metadata queries — tables, columns, measures, and relationships — which is enough to write DAX. Fabric’s item definition API is not used.
  • Power BI datasets as Athena semantic models. Athena’s semantic model layer currently supports Databricks and Snowflake connections.
  • Sovereign clouds. This integration targets Power BI on the public Microsoft cloud.