Skip to main content
Connect Power BI to Athena so members can browse reports and dashboards, inspect semantic models, and run DAX queries in chat — each acting as their own Microsoft Entra identity. Every call runs as the signed-in member, so Power BI’s own workspace and item permissions decide what they can see. A Viewer stays a Viewer.
Setup is two steps, done by two different people: your Microsoft Entra administrator registers an app, then an Athena workspace admin saves it once for the whole workspace. Members can only connect after both are done.

​
Step 1 — Register an Entra ID application (Entra admin)

  1. Microsoft Entra admin center → App registrations → New registration. Name it something recognizable, e.g. Athena — Power BI.
  2. Supported account types: Accounts in this organizational directory only (single tenant). This is the right choice for almost everyone, and it pairs with a tenant GUID in step 3.
  3. Redirect URI: platform Web, value:
    Entra compares redirect URIs as exact strings — a stray trailing slash or http instead of https fails the handshake.
  4. API permissions → Add a permission → Power BI Service → Delegated permissions, and add all four: Then Grant admin consent for your tenant.
  5. Certificates & secrets → New client secret. Copy the Value immediately; Microsoft only shows it once. Set a reminder to rotate it before it expires.
  6. Overview: copy the Application (client) ID and Directory (tenant) ID.
The permission set is read-write because Athena ships tools that refresh datasets, update parameters, take over datasets, and clone or rebind reports. Consent scope and Power BI item permissions are independent gates — granting ReadWrite does not turn a Viewer into an Editor.
Two features have extra requirements beyond these four permissions. Power BI apps: listing installed apps needs the App.Read.All delegated permission, which is not in the default set — add and consent to it (and have members reconnect) if you want app browsing; workspace reports and dashboards work without it. Report export to file (PDF/PPTX/PNG) is a Power BI capacity feature: the workspace must be on dedicated capacity (Premium/Fabric or PPU), or Power BI rejects the export regardless of permissions.

​
Step 2 — Allow REST API access in the Power BI tenant (Power BI admin)

In the Power BI admin portal → Tenant settings → Developer settings, make sure the relevant API access is enabled for the users or groups who will connect. A tenant that blocks it returns a 403 even though sign-in succeeded. Each connecting member also needs a Power BI licence.

​
Step 3 — Enable Power BI in Athena (workspace admin, once)

An Athena workspace admin or owner must add the app for the entire workspace — individual members cannot do this, and the connect option stays hidden from them until it’s done. Open Workspace Settings → Integrations, expand Power BI (Direct OAuth), click Add app, and fill in: Toggle the app on and Save app. You can register more than one app — for example one per tenant — and members get a dropdown to choose which to authorize against. Secrets are encrypted at rest and never returned to the browser.

​
Step 4 — Members connect (each user)

  1. Go to Integrations and click Power BI (Direct OAuth) → Connect.
  2. Pick the app, if more than one is enabled.
  3. Sign in to Microsoft and consent. Athena always asks you to sign in rather than reusing a cached browser session, so the connection is unambiguously yours.
  4. Confirm the Entra identity shown, then select one or more Power BI workspaces. Each becomes a catalog in Athena. You can connect several, and come back later to add more.

​
What you can do once connected

  • @-mention a report or dashboard in chat to bring it into context.
  • Ask about the data. Athena can list reports, dashboards, and datasets; read a dataset’s tables, columns, measures, and relationships; and run DAX against it to answer questions.
  • Operate on content. Refresh a dataset, check refresh history, update parameters, export a report, or clone and rebind one — all as you, within what Power BI already lets you do.
Tokens are per-user, encrypted at rest, and refreshed automatically. Power BI permissions remain the source of truth — losing access to a workspace in Power BI immediately removes what Athena can do there for that member.

​
Relationship to the Paragon Power BI integration

Athena also offers a Power BI connector brokered through Paragon, which appears on the Integrations page as its own Power BI card. Both can be enabled at once, and they share the same tools, chat behavior, and report rendering — only the sign-in path differs. The Direct OAuth picker hides any Power BI workspace you have already connected, whichever path you used, so you won’t create a duplicate by accident. The practical consequence: to move an existing workspace to Direct OAuth, disconnect its Paragon catalog first, then reconnect.

​
Troubleshooting

​
Not supported yet

  • Microsoft Fabric / TMDL semantic model definitions. Dataset schema comes from Power BI’s own metadata queries — tables, columns, measures, and relationships — which is enough to write DAX. Fabric’s item definition API is not used.
  • Power BI datasets as Athena semantic models. Athena’s semantic model layer currently supports Databricks and Snowflake connections.
  • Sovereign clouds. This integration targets Power BI on the public Microsoft cloud.