> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Power BI (Direct OAuth)
Connect Power BI to Athena so members can browse reports and dashboards, inspect
semantic models, and run DAX queries in chat — each acting as their own
Microsoft Entra identity. Every call runs as the signed-in member, so Power BI's
own workspace and item permissions decide what they can see. A Viewer stays a
Viewer.
Setup is two steps, done by two different people: your **Microsoft Entra
administrator** registers an app, then an **Athena workspace admin** saves it
once for the whole workspace. Members can only connect after both are done.
## Step 1 — Register an Entra ID application (Entra admin)
1. **Microsoft Entra admin center → App registrations → New registration**. Name
it something recognizable, e.g. `Athena — Power BI`.
2. **Supported account types**: *Accounts in this organizational directory only*
(single tenant). This is the right choice for almost everyone, and it pairs
with a tenant GUID in step 3.
3. **Redirect URI**: platform **Web**, value:
```
https://api.athenaintel.com/api/powerbi-direct/oauth/callback
```
Entra compares redirect URIs as exact strings — a stray trailing slash or
`http` instead of `https` fails the handshake.
4. **API permissions → Add a permission → Power BI Service → Delegated
permissions**, and add all four:
| Permission | Why it's needed |
| ----------------------- | -------------------------------------------------------------------- |
| `Workspace.Read.All` | List the workspaces a member can see — this is what the picker shows |
| `Dataset.ReadWrite.All` | Dataset metadata, schema, DAX queries, refresh, parameters |
| `Report.ReadWrite.All` | Report metadata, pages, export, clone and rebind |
| `Dashboard.Read.All` | Dashboards, tiles, and embed tokens |
Then **Grant admin consent for your tenant**.
5. **Certificates & secrets → New client secret**. Copy the **Value**
immediately; Microsoft only shows it once. Set a reminder to rotate it before
it expires.
6. **Overview**: copy the **Application (client) ID** and **Directory (tenant)
ID**.
The permission set is read-write because Athena ships tools that refresh
datasets, update parameters, take over datasets, and clone or rebind reports.
Consent scope and Power BI item permissions are independent gates — granting
`ReadWrite` does not turn a Viewer into an Editor.
Two features have extra requirements beyond these four permissions.
**Power BI apps**: listing installed apps needs the `App.Read.All` delegated
permission, which is not in the default set — add and consent to it (and have
members reconnect) if you want app browsing; workspace reports and dashboards
work without it. **Report export to file** (PDF/PPTX/PNG) is a Power BI
capacity feature: the workspace must be on dedicated capacity (Premium/Fabric
or PPU), or Power BI rejects the export regardless of permissions.
## Step 2 — Allow REST API access in the Power BI tenant (Power BI admin)
In the **Power BI admin portal → Tenant settings → Developer settings**, make
sure the relevant API access is enabled for the users or groups who will
connect. A tenant that blocks it returns a `403` even though sign-in succeeded.
Each connecting member also needs a Power BI licence.
## Step 3 — Enable Power BI in Athena (workspace admin, once)
An **Athena workspace admin or owner** must add the app for the **entire
workspace** — individual members cannot do this, and the connect option stays
hidden from them until it's done.
Open **[Workspace Settings →
Integrations](https://app.athenaintel.com/dashboard/workspace-settings/?tab=integrations)**,
expand **Power BI (Direct OAuth)**, click **Add app**, and fill in:
| Field | Value |
| ----------------- | -------------------------------------------------------------------------------------------------- |
| **Display name** | The label members see in the connect picker |
| **Tenant ID** | Directory (tenant) ID from step 1.6 |
| **Client ID** | Application (client) ID from step 1.6 |
| **Client Secret** | The secret **Value** from step 1.5 (write-only — leave blank when editing to keep the current one) |
Toggle the app on and **Save app**. You can register more than one app — for
example one per tenant — and members get a dropdown to choose which to authorize
against. Secrets are encrypted at rest and never returned to the browser.
## Step 4 — Members connect (each user)
1. Go to **[Integrations](https://app.athenaintel.com/dashboard/integrations/)**
and click **Power BI (Direct OAuth) → Connect**.
2. Pick the app, if more than one is enabled.
3. Sign in to Microsoft and consent. Athena always asks you to sign in rather
than reusing a cached browser session, so the connection is unambiguously
yours.
4. Confirm the Entra identity shown, then select one or more Power BI
workspaces. Each becomes a catalog in Athena. You can connect several, and
come back later to add more.
## What you can do once connected
* **@-mention a report or dashboard** in chat to bring it into context.
* **Ask about the data.** Athena can list reports, dashboards, and datasets;
read a dataset's tables, columns, measures, and relationships; and run DAX
against it to answer questions.
* **Operate on content.** Refresh a dataset, check refresh history, update
parameters, export a report, or clone and rebind one — all as you, within
what Power BI already lets you do.
Tokens are per-user, encrypted at rest, and refreshed automatically. Power BI
permissions remain the source of truth — losing access to a workspace in Power
BI immediately removes what Athena can do there for that member.
## Relationship to the Paragon Power BI integration
Athena also offers a Power BI connector brokered through Paragon, which appears
on the Integrations page as its own **Power BI** card. Both can be enabled at
once, and they share the same tools, chat behavior, and report rendering — only
the sign-in path differs.
The Direct OAuth picker hides any Power BI workspace you have already connected,
whichever path you used, so you won't create a duplicate by accident. The
practical consequence: to move an existing workspace to Direct OAuth, disconnect
its Paragon catalog first, then reconnect.
## Troubleshooting
| Symptom | Cause and fix |
| ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connect fails with a message about a token issued for something other than the Power BI REST API | The Entra app is missing the **Power BI Service** delegated permissions, or admin consent for them. Add all four from step 1.4 and reconnect. Athena checks this at connect time and refuses to save credentials that would `401` on every call. |
| `403` when listing workspaces | Sign-in worked but the tenant is not authorized. Check the Power BI admin portal developer settings (step 2), and that the member holds a Power BI licence. |
| "Entra did not return a refresh\_token" | Athena always requests `offline_access`, so the tenant is refusing it. Check that no policy blocks the `offline_access` delegated permission, then reconnect. |
| "Power BI Direct OAuth is not configured for this workspace" | A workspace admin hasn't completed step 3. |
| "You are not connected to this Power BI workspace" | The catalog exists because a colleague connected it, but you have no credentials on it. Connect from the Integrations page — you'll get your own. |
| A message that no Power BI OAuth app is configured for a catalog | The app that catalog was created against was removed from workspace settings. Re-add it, or reconnect against a current app. |
| Listing Power BI apps fails mentioning `App.Read.All` | The Apps API needs the `App.Read.All` delegated permission, which the default setup doesn't include. An Entra admin adds it (API permissions → Power BI Service → `App.Read.All`), grants consent, and the member reconnects. Workspace reports and dashboards work without it. |
| Export fails with "not on dedicated capacity" | Exporting a report to a file requires the workspace to be on Premium/Fabric dedicated capacity or PPU. Shared-capacity workspaces cannot export — this is a Power BI limit, not an Athena or permissions issue. |
| The workspace picker looks short | It pages through everything the account can see, but Power BI only returns workspaces the signed-in member has access to. Check the member's Power BI workspace roles. |
## Not supported yet
* **Microsoft Fabric / TMDL semantic model definitions.** Dataset schema comes
from Power BI's own metadata queries — tables, columns, measures, and
relationships — which is enough to write DAX. Fabric's item definition API is
not used.
* **Power BI datasets as Athena semantic models.** Athena's semantic model layer
currently supports Databricks and Snowflake connections.
* **Sovereign clouds.** This integration targets Power BI on the public
Microsoft cloud.