Skip to main content
The Microsoft Power BI connector integrates Tess with Power BI workspaces, datasets, reports, and dashboards. Once connected, the AI queries that data in natural language inside chats and agents. Power BI is part of the Tess Connectors ecosystem. Authentication is OAuth through an app registration in your organization’s Microsoft Entra ID. The registration is done once. Each person uses the same Client ID and Client Secret, and signs in with their own Microsoft account.
How access works. The agent sees exactly what the connected person sees in Power BI. Someone who is not a member of a workspace cannot read that workspace’s dataset through Tess. Tess does not widen permissions.

​
Prerequisites

​
How to connect

This connector requires admin consent in Microsoft Entra ID. Without that consent, the Microsoft sign-in screen asks for an approval the person cannot grant on their own.
1

Open the connector screen in Tess

  1. In chat, click + in the lower-left corner and choose Connectors.
  2. Click Add connectors (or Manage connectors, if one already exists) and select Microsoft Power BI.
  3. The screen asks for Client ID and Client Secret, and shows the redirect URI and the permission list the app needs. Leave it open: you will copy the URI and check the list in the permissions step.
2

Register the application in Microsoft Entra ID

  1. Go to portal.azure.com → Microsoft Entra ID → App registrations → New registration.
  2. Give it a name, for example Tess.
  3. Under Supported account types, use accounts in this organizational directory only when only people in your organization, including tenant guests, will connect.
  4. Under Redirect URI, choose the Web platform and paste the URI exactly as the connector screen shows it. If you skip this, the connection fails with No reply address is registered for the application. You can add it later under Authentication → Add a platform → Web.
  5. Click Register.
  6. On the application’s Overview, copy the Application (client) ID. That is the Client ID.
3

Create the client secret

  1. In the application, go to Certificates & secrets → New client secret. Add a description and choose an expiration. Note the expiration date: when the secret expires, create a new one and reconnect.
  2. Copy the Value field immediately. It is shown only at creation. After you leave the screen, only the Secret ID remains, and that is not the secret. It does not work in Tess.
  3. If the value was lost, create a new secret. The previous one cannot be recovered.
Paste the secret Value into Client Secret. The Secret ID does not authenticate.
4

Grant the Power BI API permissions

  1. In the application, go to API permissions → Add a permission → Power BI Service → Delegated permissions.
  2. Select the permissions listed on the connector screen:
    • Report.Read.All
    • Dataset.Read.All
    • Dashboard.Read.All
    • Workspace.Read.All
    • Content.Create
    • Dataflow.Read.All
    • offline_access
  3. Click Add permissions.
  4. Click Grant admin consent for your organization and confirm.
Permissions are added one by one through search. There is no field to paste the whole list.
5

Finish the connection in Tess

  1. Return to the connector screen, paste the Client ID and the Client Secret (the Value), and click Continue.
  2. Sign in with your Microsoft account and accept the permissions.
  3. The return window confirms the connection. Power BI appears under Connected, with a green indicator.
If you just changed the Entra registration (URI, permissions, or consent), wait one or two minutes before trying again. The change takes time to propagate.
6

Test

  1. Open a new chat and turn on the Power BI connector in the connector selector on the message box.
  2. Ask something you could answer by opening Power BI. For example: which datasets exist in your workspaces.
  3. In the reply, open the tool block. The agent shows the calls, such as Get groups, Get tables in group, and DAX Query. If the call appears and the data comes back, the connection is ready.

​
Who sees what

  • Each person connects their own Power BI. The app registration belongs to the organization. Sign-in is individual. Someone who is not a member of a workspace is told the account lacks the required permission, or that some workspaces refused access.
  • To grant access, the Power BI administrator opens the workspace, goes to Manage access, and adds the person as Member or Viewer. A shared report link does not grant workspace access.
  • If a dataset still does not respond after the person is a member, the Power BI administrator can add the registered application as a Member of the workspace. That does not replace the connected person’s access.
  • Someone outside the organization joins as a tenant guest, or with an account on the company domain. Sharing a colleague’s login records queries under the name of someone who did not run them. Prefer a guest or a service account with a defined owner.

​
What you can do

  • List workspaces and datasets the connected account can already open
  • Query dataset data in natural language
  • Read reports and dashboards visible to that account

​
Prompt examples

  1. Which datasets exist in my workspaces?
  2. In the sales dataset, which products sold the most this week?
  3. List the reports in the commercial workspace that I can open.

​
Troubleshooting

The application has no redirect URI. Under Authentication → Add a platform → Web, paste the URI shown on the connector screen.
Client Secret received the Secret ID instead of the Value. Create a new secret and copy the Value immediately.
The person is not a member of that Power BI workspace. Ask the BI administrator to add them as Member or Viewer.
This message alone does not mean the connection failed. Confirm the workspace permission and try the query again.
The connector is not enabled in the session. Turn on Power BI in the connector selector on the message box.
Admin consent is missing on the app registration. Ask the tenant administrator to click Grant admin consent.
The change is still propagating. Wait 1–2 minutes and reconnect under Manage connectors → Power BI → Reconnect.
Tess acts with the permissions of the connected account. It does not widen access beyond what that account can already do in Power BI.Connectors involve access to external systems. Only connect accounts that fit the usage context, and review permissions carefully.