Skip to main content

Set up the Power BI MCP server

Microsoft's remote Power BI MCP server lets AI agents query Power BI semantic models: executing DAX queries, reading model schemas, and inspecting report metadata, all under each user's own permissions. This guide covers enabling the preview in your Power BI tenant, registering a Microsoft Entra app for OAuth, and connecting the server to MintMCP from the recommended server catalog.

Prerequisites​

  • A MintMCP admin account
  • A Power BI (Fabric) administrator to enable the preview tenant setting
  • Permission to register applications in your Microsoft Entra tenant
  • Users need Build permission on the semantic models they will query

Enable the tenant setting​

The preview is off by default, so a Fabric administrator must enable it before any MCP client can connect.

  1. Go to the Fabric admin portal and open Tenant settings.
  2. Find Users can use the Power BI Model Context Protocol server endpoint (preview).
  3. Enable it for the entire organization, or restrict it to specific security groups.
  4. Click Apply. Tenant setting changes can take up to 15 minutes to propagate.

Register a Microsoft Entra app​

Microsoft Entra does not support dynamic client registration, so an admin registers an app once and MintMCP uses its client ID for the OAuth flow.

  1. Sign in to the Microsoft Entra admin center and go to App registrations > New registration.

  2. Enter a name, for example MintMCP Power BI.

  3. Under Supported account types, select Accounts in this organizational directory only (Single tenant).

  4. Under Redirect URI (optional), select Public client/native (mobile & desktop) and enter:

    https://app.mintmcp.com/oauth/callback
    Redirect URI section of the Entra app registration form with the platform set to Public client/native and the MintMCP OAuth callback URL entered

  5. Click Register.

  6. Go to API permissions > Add a permission > Power BI Service > Delegated permissions, and add:

    PermissionGrants
    Dataset.Read.AllRead the semantic models the user can access
    Workspace.Read.AllRead the workspaces the user can access
    MLModel.Execute.AllExecute ML models the user can access

  7. Click Grant admin consent so users are not individually prompted to consent.

  8. On the Overview page, copy the Application (client) ID.

Add Power BI to MintMCP​

Power BI is listed in the MintMCP recommended server catalog. Because Entra does not support dynamic client registration, you supply the client ID from the app you registered above.

  1. In MintMCP, go to MCP store > Manage store.
  2. Find Power BI in the recommended servers list and click Install.
  3. Under OAuth Client Advanced Settings, paste the Application (client) ID in the Client ID field.
  4. Click Save.

Each user signs in with their own Microsoft account on first use, so queries run under their identity and row-level security is enforced.

Find your semantic model ID​

The server's tools take a semantic model ID as input, so users need the IDs of the models they want to query.

  1. Sign in to Power BI and open the workspace containing the model.

  2. Select the semantic model and copy its ID from the URL:

    https://app.powerbi.com/groups/{workspaceId}/datasets/{semanticModelId}

Store frequently used model IDs where agents can find them, for example in a project instruction file.

Available tools​

ToolWhat it does
Execute QueryRuns a DAX query against a semantic model
Get Semantic Model SchemaReturns tables, columns, measures, and relationships
Get Report MetadataReturns a report's pages, visuals, and filters
Generate QueryGenerates DAX from natural language using Copilot in Power BI

Generate Query requires a Copilot license and consumes Copilot capacity. If you prefer the client LLM to write DAX instead, disable the tool with tool customization.

Security considerations​

  • Each user authenticates with their own Microsoft account, so queries are bounded by their workspace access and Build permissions, and row-level security is enforced per user.
  • The client ID alone identifies your Entra app but grants no data access on its own; access always requires a signed-in user and the delegated permissions above.
  • The delegated permissions are read and execute only. The server cannot modify semantic models, reports, or workspaces.
  • All tool calls flow through the MintMCP gateway, so they are attributed to individual users in the audit log.

Next steps​