Microsoft Power BI

The Microsoft Power BI auth provider enables tools and agents to call the Power BI REST API  on behalf of a user.

It authorizes against the Power BI Service resource (https://analysis.windows.net/powerbi/api) and reuses Microsoft’s Entra ID endpoints, but on its own connection. Keeping Power BI on a dedicated provider means its resource scopes never mix with the Microsoft Graph scopes used by the general-purpose Microsoft provider. Requesting Power BI and Graph scopes together in a single authorize request mixes token audiences and causes Microsoft Entra to reject the sign-in with AADSTS70011 (The provided value for the input parameter scope is not valid).

What’s documented here

This page describes how to use and configure Microsoft Power BI auth with Arcade.

This auth provider is used by:

• The Arcade Power BI MCP Server, which discovers workspaces, datasets, and reports; inspects and queries semantic models with DAX; and manages dataset refreshes
• Your app code that needs to call Power BI REST APIs
• Or, your custom tools that need to call Power BI REST APIs

Configuring Microsoft Power BI auth

In a production environment, you will most likely want to use your own Microsoft app credentials. This way, your users will see your application’s name requesting permission.

Before showing how to configure your Power BI app credentials, let’s go through the steps to create a Microsoft Entra app.

Create a Microsoft Entra app

• Follow Microsoft’s guide to registering an app with the Microsoft identity platform .
• Set the redirect URL to the redirect URL generated by Arcade (see below).
• Under API permissions, add the Power BI Service delegated permissions listed in the section below — and only those. Then Grant admin consent for the permissions.
• Copy the client ID and client secret to use below.

Power BI Service scopes

Add the following Power BI Service (https://analysis.windows.net/powerbi/api) delegated permissions to your Entra app. These cover the permissions used by the Arcade Power BI MCP Server:

In addition, add the standard OpenID Connect permissions openid, profile, and offline_access (the last is required to issue refresh tokens).

To enable schema inspection and DAX queries, an administrator must also turn on the Dataset Execute Queries REST API tenant setting (a.k.a. Semantic Model Execute Queries) in the Power BI admin portal.

Next, add the Power BI app to Arcade.

Configuring your own Microsoft Power BI Auth Provider in Arcade

Using Microsoft Power BI auth in app code

Use the Microsoft Power BI auth provider in your own agents and AI apps to get a user token for the Power BI REST API. See authorizing agents with Arcade to understand how this works.

Use client.auth.start() with the microsoft-powerbi provider to get a user token for Power BI APIs:

from arcadepy import Arcade
 
client = Arcade()  # Automatically finds the `ARCADE_API_KEY` env variable
 
user_id = "{arcade_user_id}"
 
# Start the authorization process
auth_response = client.auth.start(
    user_id=user_id,
    provider="microsoft-powerbi",
    scopes=[
        "https://analysis.windows.net/powerbi/api/Workspace.Read.All",
        "https://analysis.windows.net/powerbi/api/Dataset.Read.All",
    ],
)
 
if auth_response.status != "completed":
    print("Please complete the authorization challenge in your browser:")
    print(auth_response.url)
 
# Wait for the authorization to complete
auth_response = client.auth.wait_for_completion(auth_response)
 
token = auth_response.context.token
# TODO: Do something interesting with the token...

import { Arcade } from "@arcadeai/arcadejs";
 
const client = new Arcade();
 
const userId = "{arcade_user_id}";
 
// Start the authorization process
let authResponse = await client.auth.start(userId, "microsoft-powerbi", {
  scopes: [
    "https://analysis.windows.net/powerbi/api/Workspace.Read.All",
    "https://analysis.windows.net/powerbi/api/Dataset.Read.All",
  ],
});
 
if (authResponse.status !== "completed") {
  console.log("Please complete the authorization challenge in your browser:");
  console.log(authResponse.url);
}
 
// Wait for the authorization to complete
authResponse = await client.auth.waitForCompletion(authResponse);
 
const token = authResponse.context.token;
// TODO: Do something interesting with the token...

Using Microsoft Power BI auth in custom tools

You can author your own custom tools that interact with the Power BI REST API.

Power BI is a Microsoft provider with a distinct provider_id, so mark a tool as requiring it by subclassing the Microsoft auth class and overriding provider_id to microsoft-powerbi. This routes authorization to your dedicated Power BI provider and keeps the connection on Power BI Service tokens only. The context.authorization.token field will be automatically populated with the user’s Power BI token:

from typing import Annotated
 
import httpx
 
from arcade_tdk import ToolContext, tool
from arcade_tdk.auth import Microsoft
 
 
class MicrosoftPowerBI(Microsoft):
    """Microsoft OAuth bound to the dedicated `microsoft-powerbi` provider."""
 
    provider_id: str = "microsoft-powerbi"
 
 
@tool(
    requires_auth=MicrosoftPowerBI(
        scopes=["https://analysis.windows.net/powerbi/api/Dataset.Read.All"],
    )
)
async def list_datasets(
    context: ToolContext,
    group_id: Annotated[str, "The ID of the workspace to list datasets from"],
) -> Annotated[dict, "The datasets in the workspace"]:
    """List the datasets in a Power BI workspace."""
    url = f"https://api.powerbi.com/v1.0/myorg/groups/{group_id}/datasets"
    headers = {"Authorization": f"Bearer {context.authorization.token}"}
 
    async with httpx.AsyncClient() as client:
        response = await client.get(url=url, headers=headers)
        response.raise_for_status()
        return response.json()