Skip to main content
Connect your Power BI tenant to make your reports, dashboards, datasets, DAX measures, and Power Query (M) searchable in Pavo. We connect as a read-only service principal — we never modify anything in your tenant. Three steps, ~15 minutes, done by a Power BI / Fabric tenant admin:
  1. Register an app in Microsoft Entra.
  2. Grant read-only access in the Power BI admin portal.
  3. Connect in Pavo.

​
1. Register an app (Microsoft Entra)

In the Azure portal → App registrations → New registration:
  1. Name it e.g. pavo-powerbi-reader, single tenant, no redirect URI. Create it.
  2. From the overview page, copy the Directory (tenant) ID and Application (client) ID.
  3. Add a credential — certificate recommended (the private key never leaves your control; revoke any time by rotating it):
    • Certificate: Certificates & secrets → Certificates → Upload your public certificate, and note its thumbprint.
    • Client secret (simpler): Certificates & secrets → New client secret, and copy the value (shown only once).
You don’t need to add any API permissions to the app — access is granted in Step 2.

​
2. Grant read-only access (Power BI admin portal)

  1. Create a Microsoft Entra security group (e.g. pavo-powerbi) and add the app from Step 1 to it.
  2. In Power BI → Settings → Admin portal → Tenant settings, enable these for that security group (so they apply only to this app):
    • Service principals can use Power BI APIs
    • Service principals can use read-only Power BI admin APIs
    • Enhance admin API responses with detailed metadata
    • Enhance admin API responses with detailed metadata for DAX and mashup expressions
That’s it — the connector reads tenant-wide, so new workspaces are picked up automatically. No need to add it to individual workspaces.

​
3. Connect in Pavo

  1. Go to https://<your_company>.pavoai.dev/settings/workspace-connectors.
  2. Under Browse Connectors, click Power BI.
  3. Enter your Directory (tenant) ID and Application (client) ID.
  4. Provide your certificate (private key + thumbprint, plus passphrase if set) or client secret.
  5. Click Connect.
Your content starts syncing right away and becomes available to everyone in your Pavo workspace. Good to know
  • We read metadata only — never the data rows inside your datasets. Personal “My Workspace” content is never accessed.
  • Syncs keep up with changes automatically, including deletions.
  • Revoke access any time by removing the app from the security group or deleting its credential.
Questions or need any help? Reach out and we’ll help you set it up.