TL;DR

Store Power BI BIM files in Atlan, Amazon S3, or Azure Blob Storage and enable OLS dataset enrichment to recover hidden tables, columns, and lineage.

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Enrich Power BI OLS datasets

Atlan recovers Power BI tables and columns hidden by Object Level Security and restores their upstream lineage to your data warehouse.

The Power BI Admin APIs used by Atlan's crawler don't return table metadata when Object Level Security (OLS) is applied to a semantic model, so those assets are missing in Atlan and lineage is broken. When you enable OLS dataset enrichment, the crawler reads each semantic model's BIM file from object storage and uses it to create the missing assets and lineage.

Part of the Power BI crawler

OLS dataset enrichment runs as part of the Microsoft Power BI crawl, under Advanced Configuration. It was previously delivered as a separate PBI OLS Dataset Enricher app. You no longer install or schedule a separate workflow.

This guide walks you through choosing where to store BIM files, granting Atlan read access, exporting the files with Tabular Editor, and enabling enrichment on your Power BI crawler.

Prerequisites

Before you begin, make sure you have:

A Microsoft Power BI connection set up and crawled in Atlan.
The data warehouse connection (for example, Snowflake, BigQuery) crawled in Atlan so that upstream assets are available for lineage.
Tabular Editor installed and accessible from the machine where you run the extraction script.
A Service Principal authorized to authenticate Tabular Editor with the Power BI workspace and semantic model.
A Premium Capacity or Fabric Workspace.
If you store BIM files in your own Amazon S3 bucket or Azure Blob container, someone who can change access in that AWS account or Azure subscription.

Choose where to store BIM files

The crawler reads BIM files from one of two sources, set in the BIM File Source field.

	Atlan Object Storage	External Object Storage
Where the files live	Your tenant's own Atlan storage (Azure Blob on Azure-hosted tenants)	An Amazon S3 bucket or Azure Blob container, including an S3 bucket Atlan set up for you
Access to grant	None. Atlan reads it with its own platform access.	Read access for Atlan (see Grant Atlan read access)
What you enter	A BIM file prefix	Storage provider, bucket or container details, and an optional prefix

Google Cloud Storage isn't supported.

Grant Atlan read access

Grant access for the storage option you chose. No storage field on the crawler takes a secret, such as an access key or client secret.

Atlan Object Storage

Atlan reads its own object storage, so you don't need to grant access. Contact Atlan support to get a prefix and upload access for your BIM files.

Amazon S3

Atlan reads S3 with its own AWS identity. On AWS-hosted tenants, this is the node instance role. On tenants hosted on another cloud, this is an AWS role that Atlan provides for your tenant. Raise a support ticket to get the ARN of that identity.

Grant read access in one of two ways:

Grant Atlan's identity read access to the bucket. Allow s3:ListBucket on the bucket and s3:GetObject on the prefix in the bucket policy, and raise a support ticket so Atlan grants its identity the same actions. A read across AWS accounts needs both. Leave AWS Role ARN blank on the crawler.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<atlan-aws-identity-arn>" },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bim-exports"
    },
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<atlan-aws-identity-arn>" },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bim-exports/powerbi/ols/bim/*"
    }
  ]
}

Create a role in your AWS account for Atlan to assume. Attach a policy that grants the same s3:ListBucket and s3:GetObject permissions, add a trust policy that lets Atlan's identity assume the role, and enter the role's ARN in AWS Role ARN on the crawler. For the trust policy, see AWS role ARN.

Replace example-bim-exports with your bucket name, powerbi/ols/bim with your prefix, and <atlan-aws-identity-arn> with the ARN from Atlan support.

If the bucket uses a customer-managed KMS key, also grant the identity that reads the bucket kms:Decrypt on that key.

Azure Blob Storage

Atlan reads the container with the Power BI app registration already on your Power BI credential, so the credential must use service principal authentication.

In the Azure portal, open the container (or its storage account).
Assign the Storage Blob Data Reader role to the Power BI app registration.
Confirm that the storage account is in the same Microsoft Entra tenant as the app registration. If it's in a different tenant, the app registration must be multi-tenant and have a service principal in the storage account's tenant.

If your storage account or bucket restricts network access, for example with a firewall or private endpoint, contact Atlan support before you configure the crawler.

Export and upload BIM files

Before running the crawler, export each Power BI semantic model (also called a PBI dataset) to a BIM file and upload it to your storage.

Use Tabular Editor to connect to the Power BI workspace and semantic model (using the Service Principal).
Run a script to export the semantic model as a .bim file.
Upload the .bim files under the prefix you configure on the crawler, for example powerbi/ols/bim. The crawler also reads files in subfolders of the prefix.

The crawler matches each BIM file to its Power BI dataset by the model id inside the file, not by the file name. It reads up to 500 .bim files under the prefix, and the run fails if there are more. Keep only current exports under the prefix.

Enable enrichment

Once your BIM files are uploaded, enable enrichment on the Power BI crawler.

Set up the Microsoft Power BI crawler, or edit your existing Power BI workflow.
In Advanced Configuration, set Enable Power BI OLS Dataset Enrichment to True. If you later turn it off after a successful run, the crawler deletes the tables that enrichment created.
For BIM File Source, select where your BIM files are stored:
- Atlan Object Storage: Enter the BIM File Prefix you got from Atlan support, for example powerbi/ols/bim. The prefix is required because the root of your tenant's storage holds Atlan's own files.
- External Object Storage: Select a Storage Provider and enter its details.
  - AWS S3: Enter the Bucket Name (the plain name, without s3://) and Region (for example, us-west-2). Enter the AWS Role ARN only if you created a role for Atlan to assume. Enter a BIM File Prefix, or leave it blank to scan the whole bucket.
  - Azure Blob Storage: Enter the Storage Account Name and Container Name. Enter a BIM File Prefix, or leave it blank to scan the whole container.
For details on each field, see Power BI OLS dataset enrichment.
In Source Connections, select the data warehouse connections to build lineage against, so that enrichment doesn't create duplicate lineage to other connections holding the same metadata.

Configurations saved before external storage options

A crawler saved with an S3 bucket and region before the BIM File Source field existed keeps working, and reads as External Object Storage with AWS S3. If editing it shows Atlan Object Storage selected, select External Object Storage and AWS S3 instead of entering a prefix; your bucket, region, prefix, and role values are still there.

Run preflight checks and crawler

Click Preflight checks. The Ols Bim Source check lists your BIM file source, downloads one .bim file, and parses it. If it fails, see Preflight checks for Microsoft Power BI.
Save and run the crawler to create the missing tables, columns, and lineage.

If the crawler can't read the BIM file source, finds no .bim files, or can't parse any file, the crawl fails instead of continuing. This keeps the tables that earlier runs created. BIM files that parse but match no crawled dataset are logged, and the crawl continues.

Verify lineage

After the crawl finishes, validate that assets and lineage have been created as expected.

From the left navigation, click Assets.
Search for a Power BI dataset that was in scope and open its asset profile.
Click the Lineage tab and confirm that:
- The missing Power BI tables and columns now appear.
- Upstream lineage to the data warehouse tables and columns is present.
- Downstream lineage from tables to the parent dataset is present.
Repeat for a few datasets to confirm coverage matches your expectations.

If you need to adjust which semantic models are enriched, update the BIM files in your storage or the crawler configuration and run the crawler again.

Need help?

If you have any issues while configuring or running enrichment, contact Atlan support.

Prerequisites​

Choose where to store BIM files​

Grant Atlan read access​

Atlan Object Storage​

Amazon S3​

Azure Blob Storage​

Export and upload BIM files​

Enable enrichment​

Run preflight checks and crawler​

Verify lineage​

Need help?​

See also​