API permissions

Lumel EPM must obtain a set of permissions through the Azure AD app to function properly. In Azure AD, these are configured under the App Registration → API permissions section.

The following are the required and optional permissions requested, along with information on how and which features will use them.

1. Microsoft Graph (9)

1.1. Required permissions (7)

Permission
Description
Features Dependent
Actions Done from App

email

View user's email address

User Identity

Access user profile information and authentication.

Group.Read.All

Reads all groups' information. Requires admin consent.

User and Group Identity, ACL

Authorize user actions via O365 Group membership.

offline_access

Maintain access to data you have given it access to

Seamless session continuity

Maintain session without re-login

openid

Enables OpenID Connect authentication

User Authentication

Authenticate user and signs user in.

profile

View users' basic profile information

User Identity

Get profile information with Full Name, Display Name, Email, Company Name.

User.Read

Sign in and read user profile

User Identity

Sign in and read user profile.

User.ReadBasic.All

Read all users' basic profile information

User Identity

Get all users' basic profile information with Full Name, Display Name, Email, Company Name.

1.2. Optional permissions (2)

Permission
Description
Features Dependent
Actions Done from App

Files.ReadWrite.All

Full access to all files the user can access in OneDrive.

Writeback and Subscription

Writeback, and Schedule report exports to OneDrive.

Sites.ReadWrite.All

Access to SharePoint sites. Edit or delete items in all site collections.

Writeback and Subscription

Writeback, and Schedule report exports to SharePoint.

2. Power BI service (10)

2.1. Required Permissions

Permission
Description
Features Dependent
Actions Done from App

Content.Create

Create content

Dataset.Read.All

View all datasets

Data Lineage and Subscription

Create semantic model-based dropdown lists, fetch primary key column values when using key column mapping feature in writeback, refresh dataset function in semantic model-based dropdown lists and subscriptions.

Fabric.Extend

Extend Fabric with new item types

OneLake.Read.All

Make API calls that read OneLake metadata

Report.Read.All

Read all Power BI reports.

Data Lineage and Subscription

Get more information about the report where Lumel EPM is used.

Workspace.Read.All

Read access to all Power BI workspaces.

Data Lineage and Subscription

Get more information about the workspace in which the Inforiver visual is used.

2.2. Optional permissions

Permission
Description
Features Dependent
Actions Done from App

Lakehouse.Read.All

Read Lakehouses.

Lakehouse.ReadWrite.All

Access to Lakehouse destination. Read and write datasets in Lakehouse.

Writeback

Access Lakehouse destination for writeback.

SQLDatabase.Read.All

Read SQL databases.

Warehouse.Read.All

Access to PowerBI data warehouses. Fetches the connection string for the given workspace and WarehouseID.

Adding OneLake as source in Infobridge

Get the connection string for the given workspace and warehouseID. The retrieved connection string is used to access the schema and tables present in the warehouse.

3. Azure Storage (1)

Permission
Description
Features Dependent
Actions Done from App

user_impersonation

Access Azure storage using the signed-in user’s identity to writeback to these destinations: Dataverse, Databricks, ADLSGen2, and Fabric Lakehouse (on Azure storage).

Writeback

Write planning data to these Azure Storage–backed destinations using user-level authorization.

4. Azure SQL Database (1)

Permission
Description
Features Dependent
Actions Done from App

user_impersonation

Access Azure SQL Database and SQL Data Warehouse using the signed-in user’s identity to read and write planning data

Writeback

Write back planning and actuals data to Azure SQL Database/ Data Warehouse with user-level security enforcement.

Last updated

Was this helpful?