Setting Up Power BI Sentinel - Interactive Guide

🗺 Setup overview

Welcome to the setup guide

Most organisations complete setup in a few hours. Select your role above to filter to your steps, or browse all sections in order. Your progress is automatically saved in your browser.

Steps 1–5 can be completed without a Power BI Sentinel licence.

Required before you begin

Select your server region

Your setup steps contain region-specific configuration values including IP addresses, network firewall scripts, and portal URLs. Selecting the wrong region will result in a failed connection.

🇺🇸

United States

portal.powerbisentinel.com

🇪🇺

Europe

eu.powerbisentinel.com

🇦🇺

Australia

au.powerbisentinel.com

🇬🇧

United Kingdom

uk.powerbisentinel.com

✅ Region set to . Your steps will show the correct configuration values for this region. You can change it at any time by selecting a different flag above.

This guide walks through 7 steps across three roles. Use the View as filter above to show only your steps, or work through everything in order.

Step 1M365 Global Admin

Steps 2–3Azure / Infrastructure

Steps 4–7Power BI Admin

Progress by step:

M365 Global Admin: Step 1

Authorise Power BI Sentinel

Microsoft requires a Global Admin to approve Power BI Sentinel's access to your Power BI environment. One-time, ~2 minutes.

Your M365 Global Admin opens the portal and clicks Sign in With Microsoft

This registers Power BI Sentinel as an Enterprise Application in your Microsoft 365 tenant. The admin will not be signed into the portal - clicking Sign in redirects them to a Microsoft permissions approval screen only.

ℹThe person clicking this link must be your M365 Global Administrator. Anyone else, including a Power BI Admin, will not be able to grant tenant-wide consent. No Power BI Sentinel licence is required for this step.

🔗portal.powerbisentinel.com↗

Tick "Consent on behalf of your organisation" before clicking Accept

When accepting the permissions request, you may see a checkbox labelled "Consent on behalf of your organisation". Tick this before clicking Accept.

Why this matters: if you accept without ticking this box, Power BI Sentinel will only be authorised for your individual Global Admin account. Other users in your organisation won't be able to sign in to the Power BI Sentinel portal, as Microsoft won't have recorded consent at the tenant level.

Ticking the box grants consent for the entire tenant, meaning any user you invite to the portal will be able to authenticate without needing to go through this approval step again.

⚠If you do not see the "Consent on behalf of your organisation" checkbox, sign in to the Azure portal, navigate to Azure Active Directory → Enterprise Applications → Power BI Sentinel, and set the admin consent at the organisation level from there.

Azure / Infra: Step 2

Storage Account

Create an Azure Storage Account to hold your report backups, then connect it to Power BI Sentinel.

2a. Create Azure Storage Account

Power BI Sentinel stores backup copies of your Power BI reports in your own Azure Storage, so your data never leaves your control.

💡Estimated cost: ~£0.008 per GB per month (Cool tier)

Create a Storage Account in the Azure portal

Sign in and create a new Storage Account resource:

☁️portal.azure.com: Create Storage Account↗

Choose Subscription, Resource Group, and a unique lowercase name (e.g. companysentinelbackup)
Performance tab: Standard · StorageV2 · Cool · LRS or GRS
Advanced tab: Enable Hierarchical Namespace
Click Review + Create then Create

Copy the connection string and send to your Power BI Sentinel portal administrator

Storage account → Access Keys → copy either Connection String

Once created, navigate to your storage account and go to Access Keys in the left-hand menu. Copy either connection string and send it to the person who will be configuring the Power BI Sentinel portal.

Your connection string will look like this:

DefaultEndpointsProtocol=https;AccountName=yourname;AccountKey=abc123...;EndpointSuffix=core.windows.net

💡Save this connection string somewhere accessible - you will need it in Step 6a when connecting the portal. If you did not save it, return to Storage account → Access Keys to retrieve it.

2b. Configure Network Access

Open a secure network path so Power BI Sentinel's servers can reach your storage account. Choose one method based on your network setup.

⚠If you have any other Private Endpoint on this storage account, you must use Option 2. vNet firewall rules stop working once a Private Endpoint exists.

Open Azure Cloud Shell and run the vNet script

Click the >_ icon in the Azure portal toolbar, choose PowerShell, then run:

Replace the placeholders with your actual values, then paste into Cloud Shell:

powershell

Loading...

Verify under Storage account → Networking. You should see two new Virtual Network entries.

⚠If your organisation has multiple Azure subscriptions and the script returns an error, add --subscription "YOUR_SUBSCRIPTION_ID" to the end of each of the two az storage account network-rule add lines.

Copy Storage Account Resource ID and email Power BI Sentinel support

Storage account → Settings → Properties → Resource ID → help@powerbisentinel.com

Go to your Storage Account → Settings → Properties
Copy the Resource ID
Email to help@powerbisentinel.com
Once Power BI Sentinel creates the endpoint, approve the pending connection under Networking

ℹThat is all the Azure setup needed for your storage account. The actual connection to Power BI Sentinel — entering your connection string and verifying the link — is done in Step 6 once you have signed into the portal.

Azure / Infra: Step 3

SQL Database

Create an Azure SQL Database to store usage analytics and audit data, then connect it to Power BI Sentinel.

3a. Create Azure SQL Database

Power BI Sentinel uses this database to store usage analytics, audit logs, change history, and lineage data.

💡Estimated cost: ~£58/month for S2 50 DTU. Scalable up or down based on usage.

Create a SQL Database in the Azure portal

Sign in and create a new SQL Database resource:

☁️portal.azure.com: Create SQL Database↗

Same Subscription & Resource Group as your storage account
Name it e.g. PowerBISentinel
Create a new SQL Server and save the admin credentials
Click Configure database → switch to DTU-based → Standard · S2 · 50 DTU · 250 GB
Click Review + Create then Create

Ensure the database user account has db_owner role membership

The account used in the connection string must have sufficient privileges to create and manage schema objects

We recommend creating a dedicated SQL account to manage the Power BI Sentinel database connection, rather than reusing an existing admin account. This account must have the db_owner fixed database role (or at minimum db_ddladmin).

Why DDL permissions matter: Power BI Sentinel needs to create and manage its own database schema (tables, indexes, views, and stored procedures). Without DDL permissions, future schema updates will fail.

Minimum permissions required:

Object type	Minimum permission
Tables	`CREATE TABLE`
Indexes	`ALTER` on the relevant tables
Views	`CREATE VIEW`
Stored procedures	`CREATE PROCEDURE`

💡The simplest approach is to grant membership in the db_owner fixed database role, which covers all of the above. Alternatively, db_ddladmin will grant DDL permissions without full ownership.

Copy the connection string and send to your Power BI Sentinel portal administrator

SQL Database → Connection strings → ADO.NET tab, replacing {your_password}

Navigate to your SQL Database → Connection strings → ADO.NET tab. Copy the connection string and replace {your_password} with your actual password.

⚠SQL Authentication or Entra ID (password) only. Power BI Sentinel does not support MFA or passwordless authentication. Your connection string must contain a User ID and Password. Use the SQL authentication tab or Active Directory - Password tab - not Active Directory Integrated, which uses MFA.

Your connection string will look like this:

Server=tcp:yourserver.database.windows.net,1433;Initial Catalog=yourdb;User ID=youradmin;Password={your_password};Encrypt=True;

⚠ Replace {your_password} with your actual password before sharing.

💡Save this connection string somewhere accessible - you will need it in Step 6b when connecting the portal. If you did not save it, return to SQL Database → Connection strings to retrieve it.

3b. Configure Network Access

Open firewall access so Power BI Sentinel's servers can reach your SQL database, and ensure your team can connect from Power BI Desktop.

Add Power BI Sentinel IP addresses to SQL Server firewall

SQL Server → Networking → Firewall rules

Also add your own office IP range so your team can connect Power BI Desktop to the database.

Enable "Allow Azure services and resources to access this server" (optional)

On the same Networking page, toggle this setting on and click Save

💡Recommended approach: Rather than enabling this setting, we recommend configuring and using a Power BI Gateway to connect to your SQL database.

⚠Enabling this setting permits any Azure-hosted service to attempt to connect to your SQL Server, not just Power BI.

Copy SQL Server Resource ID and email Power BI Sentinel support

SQL Server → Settings → Properties → Resource ID → help@powerbisentinel.com

Go to your SQL Server (not the database) → Settings → Properties
Copy the Resource ID and email to help@powerbisentinel.com
Approve the pending connection in SQL Server → Networking once notified

ℹThat is all the Azure setup needed for your SQL database. The actual connection to Power BI Sentinel — entering your connection string, verifying the link, and optionally configuring Service Principal authentication — is done in Step 6 once you have signed into the portal.

Power BI Admin: Step 4

Configure Power BI Tenant Settings

Three settings need to be enabled in the Power BI Admin portal to unlock Power BI Sentinel's full feature set.

Enable PBIX file downloads

Open the Power BI Admin portal:

📊app.powerbi.com: Admin portal → Tenant settings↗

In Tenant settings → Export and sharing settings
Find "Download reports" and enable it

Enable XMLA endpoint read access

Required for dataset documentation, semantic search, and data lineage

Admin portal → Tenant settings → Integration settings
Find "Allow XMLA endpoints and Analyze in Excel..." and enable it

Enable Service Principal API access

Required if connecting via Service Principal. Recommended for most organisations.

ℹBoth settings below must be enabled for a specific Entra security group, not the entire organisation. Before enabling them, ensure you have an Entra ID security group with your Service Principal as a member. When enabling each setting, select Specific security groups and add that group.

Setting 1: Tenant settings → Developer settings → "Service principals can call Fabric public API"

Setting 2: Tenant settings → Admin API settings → "Service principals can access read-only admin APIs"

⚠ If your org uses PIM, a Service Principal is mandatory.

Power BI Admin: Step 5

Configure Power BI Workspace Access

Choose how Power BI Sentinel will connect to your tenant to collect metadata. Each option has different data coverage and ongoing maintenance requirements.

Ensure the Power BI Admin account has Contributor access to all workspaces

Without Contributor access, Power BI Sentinel cannot retrieve object data such as permissions, lineage, or refresh history for that workspace

If your organisation has a large number of workspaces and manually adding your admin account to each one is impractical, you can request a PowerShell script from help@powerbisentinel.com that can automate this process.

⚠This PowerShell script is not an official Power BI Sentinel product and is not a supported feature. It is provided as a helpful utility only. Use at your own discretion.

🔒 Using Privileged Identity Management (PIM)? If your organisation uses PIM, you must configure a Service Principal. User account tokens cannot be reliably maintained under PIM. Additionally, you should pause or disable PIM on the admin account used to set up Power BI Sentinel while the service completes its initial scans and workspace assignments.
→ Set up Service Principal (required for PIM)

ℹThe connection will expire after ~90 days. Simply sign back in to the Power BI Sentinel portal to renew it. We strongly recommend setting up a Service Principal for a permanent, maintenance-free connection.

Supplementary Admin User Login - Recommended Every 90 Days

A Service Principal cannot collect every data type. Even when using a Service Principal as the primary connection, a Power BI Admin user should also sign in to the Power BI Sentinel portal approximately every 90 days to ensure complete data coverage.

The following data is only accessible via a Power BI Admin user account:

Documentation: Column & Measure Usage
Change Tracking
Apps Data

Optional (Recommended)

Set Up a Service Principal

A Service Principal is a dedicated app-based identity for Power BI Sentinel to use instead of a personal account. It avoids token expiry, provides more reliable access, and is strongly recommended for most organisations.

Create a new App Registration in Azure

Azure Admin ☁️Azure Portal: App Registrations↗

Click New Registration
Set a name (e.g. PowerBISentinel)
Select Accounts in this organizational directory only
In the Redirect URI dropdown, select Web
Click Register

Note your Application (Client) ID

From the Overview page, copy the Application (client) ID

Azure Admin

Create a Client Secret

Certificates & Secrets → Client secrets → New client secret

Azure Admin

Go to Certificates & Secrets → Client secrets → New client secret
Set expiry to 24 months
Important: immediately copy the Value field. You cannot view it again.

Assign API permissions

Add only the delegated permissions listed below. Do not grant admin consent.

Azure Admin

Microsoft Graph (Delegated)

User.Read (required to log in)

Power BI Service (Delegated)

App.Read.All
Capacity.Read.All
Dashboard.Read.All
Dataflow.Read.All
Dataset.Read.All
Dataset.ReadWrite.All (required for report backups)
Gateway.Read.All
Lakehouse.Read.All (optional, for Fabric Lakehouse data)
Pipeline.Read.All (optional, for pipeline data)
Report.Read.All
Report.ReadWrite.All (required for report backups)
StorageAccount.Read.All
StorageAccount.ReadWrite.All (required for backups)
Tenant.Read.All
Tenant.ReadWrite.All (required for SP workspace access)
Workspace.Read.All
Workspace.ReadWrite.All (required for SP workspace access)

Microsoft Graph (Application, optional)

Directory.Read.All (optional, for Entra Groups and Licence data)

Create a Security Group and add the App Registration as a member

Azure Admin ☁️Azure Portal: Groups↗

Click New Group, name it e.g. PowerBISentinel-SP
Add your App Registration as a member
Click Create

Enable Service Principal access in Power BI Tenant Settings

Both settings must be enabled for your security group in the Power BI Admin portal

Power BI / Fabric Admin

ℹThis is covered in Step 4 of this guide. If you have not completed it yet, return there before continuing. ← Return to Step 4

Power BI Admin: Step 6

Sign In & Configure Power BI Sentinel Portal

Connect Power BI Sentinel to your Azure resources, configure your user permissions, and set which workspaces to monitor.

6a. Connect Azure Storage Account

Sign in to the portal and open the setup wizard, then choose your preferred authentication method for the storage connection.

Sign in to the Power BI Sentinel portal and accept the Terms & Conditions

Use the account specified on your Customer setup form, as this holds the initial licence

⚠Important: You must sign in with the same email address used during your subscription or invoice creation.

On first login you will be asked to accept our standard Terms & Conditions. These will not overwrite any pre-agreed or custom terms.

Open the account configuration wizard

Left-hand menu → Tenant Settings → "Configure my Power BI Sentinel account"

Configure my Power BI Sentinel account button

Enter your Azure Storage Account connection string

Click Setup Wizard on the Storage Account tab, paste the connection string from Step 2, and save

Click Setup Wizard on the Storage Account tab
Paste your Azure Storage connection string (from Step 2)
Leave Authentication Method set to Storage Account Key
Click Save. The wizard will display 4 green ticks to confirm success.

Power BI Sentinel Azure Data Storage setup wizard showing connection string field and Storage Account Key authentication method selected

Create or identify your Service Principal

You can reuse the App Registration from the Service Principal step, or create a new one for storage

You have two options - either is fine:

Reuse an existing App Registration: If you have already completed the optional Service Principal step, you can use that same App Registration here. The storage credentials are stored independently, so there is no conflict with the tenant connection.
Create a new App Registration: If you have not yet set up a Service Principal, follow the steps in the Service Principal step of this guide to create one, then return here to continue.

Either way, have your Application (Client) ID and a valid Client Secret ready before continuing to the next step.

Configure Service Principal authentication for Storage

Authenticate using an Azure AD Service Principal for a secure, key-free storage connection

ℹThis Service Principal is for your Azure Storage Account only. It is completely separate from the tenant Service Principal configured in Step 5. You can reuse the same app registration if you prefer, or use a different one. Either way, the credentials are stored and managed independently here.

Open the Storage Account Setup Wizard in the portal
Under Authentication Method, select Service Principal
Paste your Azure Storage connection string (from Step 2), removing AccountKey= or SharedAccessSignature= if present
Enter your Application (Client) ID and Client Secret in the Service Principal Credentials section
Click Save Credentials
Run the Azure CLI commands below to grant the Service Principal the required role on your storage account

Power BI Sentinel Azure Data Storage setup wizard with Service Principal selected, showing Application Client ID and Client Secret fields and Azure CLI role assignment commands

⚠You must run the Azure CLI as an account with Owner or User Access Administrator role on the storage account. Use Azure Cloud Shell or a locally installed Azure CLI.

bash

# Variables - update these for your environment
SUBSCRIPTION_ID="<your-subscription-id>"
RESOURCE_GROUP="<your-resource-group>"
STORAGE_ACCOUNT="<your-storage-account-name>"
APP_ID="<your-application-client-id>"
ROLE="Storage Blob Data Contributor"

# Build the resource scope
SCOPE="/subscriptions/$SUBSCRIPTION_ID"
SCOPE+="/resourceGroups/$RESOURCE_GROUP"
SCOPE+="/providers/Microsoft.Storage"
SCOPE+="/storageAccounts/$STORAGE_ACCOUNT"

# Assign the role
az role assignment create \
  --assignee $APP_ID \
  --role "$ROLE" \
  --scope "$SCOPE"

💡APP_ID and Client ID are the same GUID. Microsoft uses both terms depending on context. Find it at: Entra ID → App registrations → your app → Overview → Application (client) ID.

6b. Connect Azure SQL Database

Choose your preferred authentication method for the Azure SQL Database connection.

Enter your Azure SQL Database connection string

Click Setup Wizard on the SQL Database tab, paste the connection string from Step 3, and save

Click Setup Wizard on the SQL Database tab
Paste your Azure SQL Database connection string (from Step 3)
Leave Authentication Method set to SQL User Credentials
Click Save. The wizard will display 4 green ticks to confirm success.

Power BI Sentinel portal SQL Database setup wizard showing the connection string field and SQL User Credentials authentication method selected

Create or identify your Service Principal

You can reuse the App Registration from the Service Principal step, or create a new one for SQL

You have two options - either is fine:

Reuse an existing App Registration: If you have already completed the optional Service Principal step, you can use that same App Registration here. The SQL credentials are stored independently, so there is no conflict with the tenant connection.
Create a new App Registration: If you have not yet set up a Service Principal, follow the steps in the Service Principal step of this guide to create one, then return here to continue.

Either way, have your Application (Client) ID and a valid Client Secret ready before continuing to the next step.

Configure Service Principal authentication for SQL

Authenticate using an Azure AD Service Principal for a secure, credential-free SQL connection

ℹThis Service Principal is for your Azure SQL Database only. It is completely separate from the tenant Service Principal configured in Step 5. You can reuse the same app registration if you prefer, or use a different one. Either way, the credentials are stored and managed independently here.

Open the SQL Database Setup Wizard in the portal
Under Authentication Method, select Service Principal
Paste your Azure SQL connection string (from Step 3), removing User ID= and Password= if present
Enter your Application (Client) ID and Client Secret in the Service Principal Credentials section
Click Save Credentials
Run the SQL commands below to grant the Service Principal access to your database

Power BI Sentinel portal SQL Database setup wizard with Service Principal selected, showing Application Client ID and Client Secret fields and SQL grant commands for master and target databases

⚠These SQL commands must be run by an Azure AD admin on your SQL Server. Use Azure Data Studio, SSMS, or the Azure portal query editor.

Step 1 of 2: Run on the master database

Requires the loginmanager or sysadmin role. This creates the server-level login for the Service Principal.

sql: master database

-- Connect to the master database first
CREATE LOGIN [your-app-display-name]
FROM EXTERNAL PROVIDER;

Step 2 of 2: Run on your Power BI Sentinel database

Switch to the database created in Step 3. This creates the database user and grants it full schema management rights.

sql: Power BI Sentinel database

-- Connect to your Power BI Sentinel database
CREATE USER [your-app-display-name]
FROM EXTERNAL PROVIDER;

-- Grant db_owner so Sentinel can manage its own schema
ALTER ROLE db_owner
ADD MEMBER [your-app-display-name];

💡Use the app registration display name from Entra ID, not the Client ID. Find it at: Entra ID → App registrations → your app → Overview → Display name.

🎉Once both connections are confirmed, Power BI Sentinel will begin its overnight scan.

6c. Permissions Configuration (optional for Service Principal users)

Configure the API permissions for your logged-in user account. The core Power BI permissions were granted when your M365 admin authorised the app in Step 1, but there are optional permissions you can activate to extract more detailed data.

ℹThese are user-level permissions. They apply to the currently logged-in user. We recommend your Power BI admin user configures these first. If you are using a Service Principal, the SP permissions are configured separately in the Service Principal step.

Open Application Permissions from your user profile

Click your user profile icon at the top-right of the Power BI Sentinel portal menu bar, then click Application Permissions

This will open the permissions summary page. You will see two tabs: a Quick permissions tab for enabling groups at once, and an Individual permissions tab for granular control.

Switch to the Individual Permissions tab and review the full permissions list

Click the right-hand tab labelled Individual permissions to see every permission Power BI Sentinel can use

The core Power BI permissions (listed as Required below) will already be active from the M365 admin consent in Step 1. The optional permissions can be activated individually to unlock additional features.

⚠Important: Each permission must be activated separately. When you enable a permission, the browser will log you out and back in to confirm the change was saved. This is expected behaviour.

Full permissions reference

Scope	Description	Status
Power BI permissions
`App.Read.All`	View all Power BI apps	Required
`Capacity.Read.All`	View all capacities	Required
`Dashboard.Read.All`	View all dashboards	Required
`Dataflow.Read.All`	View all dataflows	Required
`Dataset.Read.All`	View all datasets	Required
`Gateway.Read.All`	View all gateways	Required
`Report.Read.All`	View all reports	Required
`Tenant.Read.All`	View all content in Power BI tenant	Required
`Workspace.Read.All`	View all workspaces	Required
Fabric permissions
`Pipeline.Read.All`	View all deployment pipelines	Optional
`Lakehouse.Read.All`	View all lakehouses	Optional
ABF Backup permissions
`Dataset.ReadWrite.All`	Read and write all datasets (required for ABF dataset backups)	Optional
`StorageAccount.Read.All`	View all storage accounts (required for ABF dataset backups)	Optional
`StorageAccount.ReadWrite.All`	Read and write all storage accounts (required for ABF dataset backups)	Optional
Service Principal permissions
`Tenant.ReadWrite.All`	Required for SP to be assigned to workspaces	Optional
`Workspace.ReadWrite.All`	Required for SP to be assigned to workspaces	Optional
Microsoft Graph permissions
`Directory.Read.All`	Read directory data (Entra groups, users, and apps)	Recommended
`User.Read.All`	Read all users' full profiles (for user licence data)	Optional

Enable Directory.Read.All (strongly recommended)

Activate this Microsoft Graph permission to allow Power BI Sentinel to access your Entra groups data and user licensing information

💡Enabling Directory.Read.All is strongly recommended. Without it, Power BI Sentinel cannot resolve Entra group memberships or display licensing data in your reports.

Click the toggle next to Directory.Read.All in the Individual permissions list. Your browser will log you out and back in to confirm the change.

Enable any additional optional permissions your organisation needs

Review the table above and activate permissions for the features you plan to use

Common optional permissions to consider:

Dataset.ReadWrite.All + StorageAccount.ReadWrite.All if you plan to use ABF dataset backups
Pipeline.Read.All if you use Power BI deployment pipelines
Lakehouse.Read.All if you use Fabric Lakehouses
User.Read.All for detailed user licence reporting

Remember: each permission will trigger a sign-out and sign-in cycle when activated.

6d. Service Principal Configuration

Connect your Service Principal to the Power BI Sentinel portal and configure workspace access settings.

Enter Client ID and Secret in the Power BI Sentinel portal

Configure screen → Server Config → enable "Use Service Principal"

Power BI / Fabric Admin

Go to the Configure screen in the Power BI Sentinel portal
Under Server Config, enable "Use Service Principal"
Enter your Client ID and Client Secret
Click Save

Advanced options

✓ Recommended

Always Use Service Principal for Backups

Uses the Service Principal as the primary account for all backups.

⚠ Not recommended

Only Use Service Principal

Disables fallback to other accounts. Leave disabled unless advised by support.

✓ Strongly recommended

Grant Service Principal "Contributor" access to all workspaces automatically

When enabled, the Service Principal will automatically assign itself Contributor access to every workspace in your tenant, including workspaces created in the future.

⚠Prerequisite: This option will not appear in the portal unless the logged-in Power BI Admin has first enabled the two required permissions in the Application Permissions screen. ← Complete Step 6c first

Activate these two permissions in the portal to unlock this option:

🔗portal.powerbisentinel.com/Config/Permissions↗

Scope	Description
`Tenant.ReadWrite.All`	Required for the SP to be assigned to workspaces
`Workspace.ReadWrite.All`	Required for the SP to be assigned to workspaces

How this works

The Service Principal uses the Power BI Admin user's access token to visit each workspace and update its own membership to Contributor. The admin does not need to remain actively signed in - their token simply needs to be active, which it will be within 90 days of their last sign-in.

⚠If the admin user's token has expired (more than 90 days since their last sign-in), or PIM deactivates their role, the Service Principal will be unable to grant itself access to any remaining workspaces. Ensure the admin user has signed in within the last 90 days before starting this process, and ensure PIM is not set to expire during it.

ℹRate limit: Power BI limits workspace membership changes to 200 workspaces per hour. For larger tenants this process can take several hours or up to a full day to complete. Progress runs automatically in the background.

Power BI Admin: Step 7

Invite Users & Connect Report Templates

Add your team to the Power BI Sentinel portal and connect the pre-built Power BI dashboards to start exploring your data.

Invite team members to the Power BI Sentinel portal

Power BI Sentinel portal → Home → User Administration → invite by email

Download and connect Power BI report templates

After first overnight scan: powerbisentinel.com/reports

Wait for the first overnight scan to complete
Download templates from powerbisentinel.com/reports
Open in Power BI Desktop and enter your Azure SQL connection string from step 3
Templates include: usage dashboards, audit logs, lineage maps, permissions reports

🎉Once the first scan completes, backups, documentation, and change tracking are all immediately available in the Power BI Sentinel portal.

Power BI Sentinel: Setup Guide

Welcome to the setup guide

Select your server region

🎉 Setup complete!

Authorise Power BI Sentinel

Storage Account

2a. Create Azure Storage Account

2b. Configure Network Access

SQL Database

3a. Create Azure SQL Database

3b. Configure Network Access

Configure Power BI Tenant Settings

Configure Power BI Workspace Access

Set Up a Service Principal

Sign In & Configure Power BI Sentinel Portal

6a. Connect Azure Storage Account

6b. Connect Azure SQL Database

6c. Permissions Configuration (optional for Service Principal users)

6d. Service Principal Configuration

Invite Users & Connect Report Templates