API permissions

Lumel EPM must obtain a set of permissions through the Azure AD app to function properly. In Azure AD, these are configured under the App Registration → API permissions section.

The following are the required and optional permissions requested, along with information on how and which features will use them.

1. Microsoft Graph (9)

1.1. Required permissions (7)

Permission	Description	Features Dependent	Actions Done from App
email	View user's email address	User Identity	Access user profile information and authentication.
Group.Read.All	Reads all groups' information. Requires admin consent.	User and Group Identity, ACL	Authorize user actions via O365 Group membership.
offline_access	Maintain access to data you have given it access to	Seamless session continuity	Maintain session without re-login
openid	Enables OpenID Connect authentication	User Authentication	Authenticate user and signs user in.
profile	View users' basic profile information	User Identity	Get profile information with Full Name, Display Name, Email, Company Name.
User.Read	Sign in and read user profile	User Identity	Sign in and read user profile.
User.ReadBasic.All	Read all users' basic profile information	User Identity	Get all users' basic profile information with Full Name, Display Name, Email, Company Name.

1.2. Optional permissions (2)

Permission	Description	Features Dependent	Actions Done from App
Files.ReadWrite.All	Full access to all files the user can access in OneDrive.	Writeback and Subscription	Writeback, and Schedule report exports to OneDrive.
Sites.ReadWrite.All	Access to SharePoint sites. Edit or delete items in all site collections.	Writeback and Subscription	Writeback, and Schedule report exports to SharePoint.

2. Power BI service (10)

2.1. Required Permissions

Permission	Description	Features Dependent	Actions Done from App
Content.Create	Create content
Dataset.Read.All	View all datasets	Data Lineage and Subscription	Create semantic model-based dropdown lists, fetch primary key column values when using key column mapping feature in writeback, refresh dataset function in semantic model-based dropdown lists and subscriptions.
Fabric.Extend	Extend Fabric with new item types
OneLake.Read.All	Make API calls that read OneLake metadata
Report.Read.All	Read all Power BI reports.	Data Lineage and Subscription	Get more information about the report where Lumel EPM is used.
Workspace.Read.All	Read access to all Power BI workspaces.	Data Lineage and Subscription	Get more information about the workspace in which the Inforiver visual is used.

2.2. Optional permissions

Permission	Description	Features Dependent	Actions Done from App
Lakehouse.Read.All	Read Lakehouses.
Lakehouse.ReadWrite.All	Access to Lakehouse destination. Read and write datasets in Lakehouse.	Writeback	Access Lakehouse destination for writeback.
SQLDatabase.Read.All	Read SQL databases.
Warehouse.Read.All	Access to PowerBI data warehouses. Fetches the connection string for the given workspace and WarehouseID.	Adding OneLake as source in Infobridge	Get the connection string for the given workspace and warehouseID. The retrieved connection string is used to access the schema and tables present in the warehouse.

3. Azure Storage (1)

Permission	Description	Features Dependent	Actions Done from App
user_impersonation	Access Azure storage using the signed-in user’s identity to writeback to these destinations: Dataverse, Databricks, ADLSGen2, and Fabric Lakehouse (on Azure storage).	Writeback	Write planning data to these Azure Storage–backed destinations using user-level authorization.

4. Azure SQL Database (1)

Permission	Description	Features Dependent	Actions Done from App
user_impersonation	Access Azure SQL Database and SQL Data Warehouse using the signed-in user’s identity to read and write planning data	Writeback	Write back planning and actuals data to Azure SQL Database/ Data Warehouse with user-level security enforcement.