## Preflight checks for Microsoft Power BI

URL: https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-power-bi/references/preflight-checks-for-microsoft-power-bi

> Before [running the Microsoft Power BI crawler](/apps/connectors/business-intelligence/microsoft-power-bi/how-tos/crawl-microsoft-power-bi), you can run.

Before [running the Microsoft Power BI crawler](https://docs.atlan.com/llms/connectors/microsoft-power-bi/crawl-microsoft-power-bi/llms.txt), you can run [preflight checks](https://docs.atlan.com/llms/catalog/connector-capabilities/what-are-preflight-checks/llms.txt) to perform the necessary technical validations. The checks correspond to the two permission layers — see [The two permission layers](https://docs.atlan.com/llms/connectors/microsoft-power-bi/power-bi-two-permission-layers/llms.txt) for background.

:::info Green preflight ≠ successful run
Preflight validates *access*. Runs can still fail later at the publish stage — circuit breaker trips, lineage reference errors, timeouts on very large estates. Those are covered in [Connectivity errors](https://docs.atlan.com/llms/connectors/microsoft-power-bi/microsoft-power-bi-connectivity-errors/llms.txt).
:::

## Credentials scopes

Validates Layer 1 — token issuance from Entra ID.

✅ `Check successful`

❌ Source returned error — classic causes: `AADSTS7000215` (Secret ID pasted instead of Value) or `AADSTS7000222` (secret expired).

For example: `Credentials Scopes: Failed with response{"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '832d86c8-cd9b-43a5-b165-ab40fb49770b'.\r\nTrace ID: 654ce9b2-a626-4e0b-8598-0cac69970200\r\nCorrelation ID: 5be327fc-93cb-4bef-ab4e-0373f11a8017\r\nTimestamp: 2022-10-31 09:03:41Z","error_codes":[7000215],"timestamp":"2022-10-31 09:03:41Z","trace_id":"654ce9b2-a626-4e0b-8598-0cac69970200","correlation_id":"5be327fc-93cb-4bef-ab4e-0373f11a8017","error_uri":"https://login.microsoftonline.com/error?code=7000215"}#STATUS:401`

## Workspace permissions

Validates Layer 2 — `GET /v1.0/myorg/groups` via Fabric public APIs.

✅ `Check successful`

❌ `No workspaces available` — the service principal has no workspace access. A 401 response indicates the "Fabric public APIs" tenant setting is disabled or the SP is not in the required security group.

## Metadata scan and fetch refreshables

Validates Layer 2 — admin/scanner APIs.

✅ `Check successful`

❌ Source returned error — classic cause: `PowerBINotAuthorizedException` 401, which means the read-only admin APIs tenant setting is disabled.

For example: `Permissions to scan metadata and fetch refreshables: Failed with response{"error":{"code":"PowerBINotAuthorizedException","pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}}}#STATUS:401`

---