Preflight checks for Microsoft Power BI
Before [running the Microsoft Power BI crawler](/apps/connectors/business-intelligence/microsoft-power-bi/how-tos/crawl-microsoft-power-bi), you can run.
Before running the Microsoft Power BI crawler, you can run preflight checks to perform the necessary technical validations. The checks correspond to the two permission layers — see The two permission layers for background.
Preflight validates access. Runs can still fail later at the publish stage — circuit breaker trips, lineage reference errors, timeouts on very large estates. Those are covered in Connectivity errors.
The checks below also don't cover every permission a run uses: they confirm that some workspaces are visible, not that your role on each one is high enough, and they never call the Fabric API behind column and measure lineage. A green preflight can be followed by a successful run with that lineage missing. See No column or measure lineage.
Credentials scopes
Validates Layer 1 — token issuance from Entra ID.
✅ Check successful
❌ Source returned error — classic causes: AADSTS7000215 (Secret ID pasted instead of Value) or AADSTS7000222 (secret expired).
For example: Credentials Scopes: Failed with response{"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '832d86c8-cd9b-43a5-b165-ab40fb49770b'.\r\nTrace ID: 654ce9b2-a626-4e0b-8598-0cac69970200\r\nCorrelation ID: 5be327fc-93cb-4bef-ab4e-0373f11a8017\r\nTimestamp: 2022-10-31 09:03:41Z","error_codes":[7000215],"timestamp":"2022-10-31 09:03:41Z","trace_id":"654ce9b2-a626-4e0b-8598-0cac69970200","correlation_id":"5be327fc-93cb-4bef-ab4e-0373f11a8017","error_uri":"https://login.microsoftonline.com/error?code=7000215"}#STATUS:401
Workspace permissions
Validates Layer 2 — GET /v1.0/myorg/groups via Fabric public APIs.
✅ Check successful
❌ No workspaces available — the service principal has no workspace access. A 401 response indicates the "Fabric public APIs" tenant setting is disabled or the SP is not in the required security group.
Metadata scan and fetch refreshables
Validates Layer 2 — admin/scanner APIs.
✅ Check successful
❌ Source returned error — classic cause: PowerBINotAuthorizedException 401, which means the read-only admin APIs tenant setting is disabled.
For example: Permissions to scan metadata and fetch refreshables: Failed with response{"error":{"code":"PowerBINotAuthorizedException","pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}}}#STATUS:401