> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tess.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Power BI

> Connect Power BI to Tess so agents can query datasets, reports, and workspaces in natural language.

The **Microsoft Power BI** connector integrates Tess with Power BI workspaces, datasets, reports, and dashboards. Once connected, the AI queries that data in natural language inside chats and agents.

Power BI is part of the Tess [Connectors](/en/connectors) ecosystem. Authentication is **OAuth** through an **app registration in your organization's Microsoft Entra ID**. The registration is done once. Each person uses the same Client ID and Client Secret, and signs in with their own Microsoft account.

<Info>
  **How access works.** The agent sees exactly what the connected person sees in Power BI. Someone who is not a member of a workspace cannot read that workspace's dataset through Tess. Tess does not widen permissions.
</Info>

## Prerequisites

| What | Who |
| - | - |
| A Microsoft 365 account with a Power BI license (Pro or higher) and access to the workspaces the agent will query | The person connecting |
| Permission to register an application in Microsoft Entra ID ([portal.azure.com](https://portal.azure.com)) | IT |
| Permission to grant admin consent for the Power BI API permissions | Microsoft tenant administrator |

## How to connect

<Warning>
  This connector requires **admin consent** in Microsoft Entra ID. Without that consent, the Microsoft sign-in screen asks for an approval the person cannot grant on their own.
</Warning>

<Steps>
  <Step title="Open the connector screen in Tess">
    1. In chat, click **+** in the lower-left corner and choose **Connectors**.
    2. Click **Add connectors** (or **Manage connectors**, if one already exists) and select **Microsoft Power BI**.
    3. The screen asks for **Client ID** and **Client Secret**, and shows the **redirect URI** and the **permission list** the app needs. Leave it open: you will copy the URI and check the list in the permissions step.
  </Step>

  <Step title="Register the application in Microsoft Entra ID">
    1. Go to [portal.azure.com](https://portal.azure.com) → **Microsoft Entra ID** → **App registrations** → **New registration**.
    2. Give it a name, for example `Tess`.
    3. Under **Supported account types**, use accounts in this organizational directory only when only people in your organization, including tenant guests, will connect.
    4. Under **Redirect URI**, choose the **Web** platform and paste the URI exactly as the connector screen shows it. If you skip this, the connection fails with `No reply address is registered for the application`. You can add it later under **Authentication** → **Add a platform** → **Web**.
    5. Click **Register**.
    6. On the application's **Overview**, copy the **Application (client) ID**. That is the **Client ID**.
  </Step>

  <Step title="Create the client secret">
    1. In the application, go to **Certificates & secrets** → **New client secret**. Add a description and choose an expiration. Note the expiration date: when the secret expires, create a new one and reconnect.
    2. Copy the **Value** field immediately. It is shown only at creation. After you leave the screen, only the **Secret ID** remains, and that is not the secret. It does not work in Tess.
    3. If the value was lost, create a new secret. The previous one cannot be recovered.

    <Warning>
      Paste the secret **Value** into Client Secret. The **Secret ID** does not authenticate.
    </Warning>
  </Step>

  <Step title="Grant the Power BI API permissions">
    1. In the application, go to **API permissions** → **Add a permission** → **Power BI Service** → **Delegated permissions**.

    2. Select the permissions listed on the connector screen:

       * `Report.Read.All`
       * `Dataset.Read.All`
       * `Dashboard.Read.All`
       * `Workspace.Read.All`
       * `Content.Create`
       * `Dataflow.Read.All`
       * `offline_access`

    3. Click **Add permissions**.

    4. Click **Grant admin consent** for your organization and confirm.

    Permissions are added one by one through search. There is no field to paste the whole list.
  </Step>

  <Step title="Finish the connection in Tess">
    1. Return to the connector screen, paste the **Client ID** and the **Client Secret** (the Value), and click **Continue**.
    2. Sign in with your Microsoft account and accept the permissions.
    3. The return window confirms the connection. Power BI appears under **Connected**, with a green indicator.

    If you just changed the Entra registration (URI, permissions, or consent), wait one or two minutes before trying again. The change takes time to propagate.
  </Step>

  <Step title="Test">
    1. Open a new chat and turn on the **Power BI** connector in the connector selector on the message box.
    2. Ask something you could answer by opening Power BI. For example: which datasets exist in your workspaces.
    3. In the reply, open the tool block. The agent shows the calls, such as `Get groups`, `Get tables in group`, and `DAX Query`. If the call appears and the data comes back, the connection is ready.
  </Step>
</Steps>

## Who sees what

* **Each person connects their own Power BI.** The app registration belongs to the organization. Sign-in is individual. Someone who is not a member of a workspace is told the account lacks the required permission, or that some workspaces refused access.
* To grant access, the Power BI administrator opens the workspace, goes to **Manage access**, and adds the person as **Member** or **Viewer**. A shared report link does not grant workspace access.
* If a dataset still does not respond after the person is a member, the Power BI administrator can add the registered application as a **Member** of the workspace. That does not replace the connected person's access.
* Someone outside the organization joins as a tenant **guest**, or with an account on the company domain. Sharing a colleague's login records queries under the name of someone who did not run them. Prefer a guest or a service account with a defined owner.

## What you can do

* **List workspaces and datasets** the connected account can already open
* **Query dataset data** in natural language
* **Read reports and dashboards** visible to that account

## Prompt examples

> 1. Which datasets exist in my workspaces?
> 2. In the sales dataset, which products sold the most this week?
> 3. List the reports in the commercial workspace that I can open.

## Troubleshooting

<AccordionGroup>
  <Accordion title="No reply address is registered for the application" icon="circle-exclamation">
    The application has no redirect URI. Under **Authentication** → **Add a platform** → **Web**, paste the URI shown on the connector screen.
  </Accordion>

  <Accordion title="Connection fails right after creating the secret" icon="circle-exclamation">
    Client Secret received the **Secret ID** instead of the **Value**. Create a new secret and copy the Value immediately.
  </Accordion>

  <Accordion title="Connected, but the agent says it has no permission on the workspace" icon="user-shield">
    The person is not a member of that Power BI workspace. Ask the BI administrator to add them as Member or Viewer.
  </Accordion>

  <Accordion title="None of your workspaces are on dedicated, Premium, or Fabric capacity" icon="circle-question">
    This message alone does not mean the connection failed. Confirm the workspace permission and try the query again.
  </Accordion>

  <Accordion title="The connector shows as connected, but the reply ignores Power BI" icon="circle-question">
    The connector is not enabled in the session. Turn on Power BI in the connector selector on the message box.
  </Accordion>

  <Accordion title="The Microsoft sign-in screen asks for admin approval" icon="user-shield">
    Admin consent is missing on the app registration. Ask the tenant administrator to click **Grant admin consent**.
  </Accordion>

  <Accordion title="Failure right after changing the Entra registration" icon="circle-question">
    The change is still propagating. Wait 1–2 minutes and reconnect under **Manage connectors** → **Power BI** → **Reconnect**.
  </Accordion>
</AccordionGroup>

<Note>
  Tess acts with the permissions of the connected account. It does not widen access beyond what that account can already do in Power BI.

  Connectors involve access to external systems. Only connect accounts that fit the usage context, and review permissions carefully.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.