Power BI Integration

Publish data product output ports directly to Microsoft Power BI as governed semantic models.

Entropy Data integrates with Microsoft Fabric / Power BI through the Power BI Web open-in integration. From an output port's Open in menu, a user can create a Power BI semantic model in one of their own Fabric workspaces. Entropy Data generates the TMDL from the data contract, wires up the underlying Snowflake or Databricks connection, and records the published model as a governed consumer data product with an access agreement.

How it works

1. An organization owner turns on the integration (global feature flag) and configures Power BI credentials for the organization — either SSO-based (if members sign in via Microsoft Entra SSO) or a custom Entra application registered for Entropy Data.
2. Each user connects their own Microsoft Entra account to Entropy Data once, granting the permissions needed to read Fabric workspaces and create semantic models on their behalf. Tokens are stored encrypted in Entropy Data and refreshed automatically.
3. When a user opens the Power BI Web action on an output port, Entropy Data:
   • generates a TMDL semantic model from the output port's data contract (ODCS),
   • creates it in the Fabric workspace the user selects,
   • binds it to a Fabric connection — reusing an existing one if the data-source parameters match, or prompting the user to enter credentials for a new one,
   • creates a consumer data product and an approved data-usage agreement in Entropy Data so the published model is visible in lineage and reuse.
4. Previously-published semantic models appear on the output port page, so users can jump straight to them in Power BI.

Supported output port types for the underlying Fabric connection: Snowflake and Databricks.

Prerequisites

• An Entropy Data Enterprise License or the Cloud Edition.
• A Microsoft Entra ID tenant with either:
  • Option A — SSO-based credentials. Your organization's members sign in to Entropy Data via Entra ID / Microsoft SSO. The existing SSO application is reused for the Power BI user-delegation flow.
  • Option B — Custom Entra application. A dedicated application registration in your Entra tenant with the permissions and redirect URI described below.
• The global feature flag must be enabled: set APPLICATION_POWERBI_WEB_ENABLED=true in your environment. See Configuration.
• A 64-hex-character APPLICATION_ENCRYPTION_KEYS must be configured so that stored client secrets and user tokens are encrypted at rest.
• A signing key for OAuth state and remember-me cookies: set APPLICATION_SECURITY_REMEMBERME_KEY to a stable, deployment-specific value (generate one with openssl rand -hex 32). This must be shared across all replicas and kept stable across restarts; rotating it invalidates in-flight OAuth flows and remember-me cookies.

Option A: SSO-based credentials

If your organization already uses Microsoft Entra SSO to log in to Entropy Data, the same Entra application can be used for the Power BI integration.

1. In the Entra portal, open your Entropy Data SSO application and add the following redirect URI under Authentication → Web:

   https:///powerbi/callback
   

   CopyCopied!

2. Under API permissions, add the delegated permissions listed in the Required permissions section below.

3. In Entropy Data, navigate to Settings > Power BI (as an organization owner) and select Use SSO credentials.

4. Save. The settings page displays the resolved application name from Microsoft Graph so you can confirm you are pointing at the right app.

Option B: Custom Entra application

When Entropy Data SSO does not use Microsoft, or you prefer a dedicated application for the Power BI integration, register a new Entra application.

1. In the Entra portal, Register a new application. Give it a descriptive name like Entropy Data — Power BI.

2. Under Authentication → Web, add the redirect URI:

   https:///powerbi/callback
   

   CopyCopied!

3. Under Certificates & secrets, create a new Client secret and note the value — it is shown only once.

4. Under API permissions, add the delegated permissions listed below and grant admin consent for your tenant.

5. In Entropy Data, navigate to Settings > Power BI (as an organization owner) and select Use custom credentials. Enter the Tenant ID, Client ID, and Client Secret of your new application, then click Test connection to verify.

6. Save. Credentials are encrypted at rest using APPLICATION_ENCRYPTION_KEYS. The client secret is never returned from the API after save.

Required permissions

The Entra application needs the following delegated Microsoft API permissions:

offline_access is required so Entropy Data can refresh the user's access token in the background. Without it, the integration works for the first few minutes after connect and then fails.

Connecting your Microsoft account

Each user connects once from Your profile > Power BI connections, or by clicking Connect to Power BI inside the Power BI Web modal on an output port. Users can disconnect at any time; disconnect revokes the stored tokens and removes the row from user_datasource_connection.

The consent dialog is shown on the initial connect. A Reconnect link is available in Your Profile which explicitly re-prompts for consent (useful if new permissions were added to the Entra application).

Publishing an output port

On a data product page, open a Snowflake or Databricks output port and choose Power BI Web from the Open in dropdown.

The modal walks through:

• Workspace — one of your Fabric workspaces.
• Semantic model name — defaults to the output port name.
• Connection — either an existing Fabric connection whose data source matches, or Create a new connection. For new connections, you supply credentials in-modal:
  • Snowflake: Basic (username + password).
  • Databricks: Personal Access Token or OAuth2 Service Principal.

Publishing runs asynchronously. A progress bar shows the phase (validating → creating connection → creating model → binding → finalizing). The resulting semantic model opens in Power BI on success.

Each successful publish creates a consumer data product plus an approved data-usage agreement in Entropy Data, so the relationship between the source output port and the downstream Power BI model appears in lineage.

Limitations

• Only Snowflake and Databricks are supported as Fabric connection sources today.
• The integration creates new semantic models; it does not update existing ones with the same name. Double-click / retry of the publish button within the same in-flight job is collapsed into one publish, but re-publishing after completion produces a fresh model with a suffix.
• Power BI itself allows duplicate display names inside a workspace. Choose distinct names if you intend to publish the same output port multiple times.
• Per-user tokens expire after ~1 hour and are refreshed automatically so long as offline_access is granted.