> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pavoai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding the Power BI Connector

> Register a read-only service principal so Pavo can make your Power BI content searchable.

Connect your Power BI tenant to make your reports, dashboards, datasets, DAX measures, and Power Query (M) searchable in Pavo. We connect as a **read-only service principal** — we never modify anything in your tenant.

Three steps, \~15 minutes, done by a **Power BI / Fabric tenant admin**:

1. **Register an app** in Microsoft Entra.
2. **Grant read-only access** in the Power BI admin portal.
3. **Connect in Pavo.**

## 1. Register an app (Microsoft Entra)

In the Azure portal → *App registrations → New registration*:

1. Name it e.g. pavo-powerbi-reader, single tenant, no redirect URI. Create it.
2. From the overview page, copy the **Directory (tenant) ID** and **Application (client) ID**.
3. Add a credential — **certificate recommended** (the private key never leaves your control; revoke any time by rotating it):
   * **Certificate:** *Certificates & secrets → Certificates → Upload* your public certificate, and note its **thumbprint**.
   * **Client secret** (simpler): *Certificates & secrets → New client secret*, and copy the **value** (shown only once).

You don't need to add any API permissions to the app — access is granted in Step 2.

## 2. Grant read-only access (Power BI admin portal)

1. Create a Microsoft Entra **security group** (e.g. pavo-powerbi) and add the app from Step 1 to it.
2. In Power BI → *Settings → Admin portal → Tenant settings*, enable these **for that security group** (so they apply only to this app):
   * **Service principals can use Power BI APIs**
   * **Service principals can use read-only Power BI admin APIs**
   * **Enhance admin API responses with detailed metadata**
   * **Enhance admin API responses with detailed metadata for DAX and mashup expressions**

That's it — the connector reads tenant-wide, so new workspaces are picked up automatically. No need to add it to individual workspaces.

## 3. Connect in Pavo

1. Go to https\://`<your_company>`.pavoai.dev/settings/workspace-connectors.
2. Under **Browse Connectors**, click **Power BI**.
3. Enter your **Directory (tenant) ID** and **Application (client) ID**.
4. Provide your **certificate** (private key + thumbprint, plus passphrase if set) or **client secret**.
5. Click **Connect**.

Your content starts syncing right away and becomes available to everyone in your Pavo workspace.

**Good to know**

* We read metadata only — never the data rows inside your datasets. Personal "My Workspace" content is never accessed.
* Syncs keep up with changes automatically, including deletions.
* Revoke access any time by removing the app from the security group or deleting its credential.

Questions or need any help? Reach out and we'll help you set it up.