MCP Server for Microsoft Power BI XMLA

Build 24.0.9300

Establishing a Connection

The CData MCP Server for Microsoft Power BI XMLA defines each connection to Microsoft Power BI XMLA as a named configuration that Claude can use when sending natural language queries.

You create and manage these configurations using the MCP Configuration Tool, which automatically handles formatting, storage, and registration with Claude Desktop.

Understanding Connection Configurations

Each connection configuration is stored in a .mcp file, located in ~/AppData/Roaming/CData/Microsoft Power BI XMLA Data Provider/, and includes the details needed to initialize the connector when Claude starts a session. For example, a connection called "MyConnection" is stored at ~/AppData/Roaming/CData/Microsoft Power BI XMLA Data Provider/MyConnection.mcp.

The .mcp file is a text file containing a line-delimited list of connection properties, plus a timestamp. For example, MyConnection.mcp contains the following text: 

#Tue May 20 15:48:40 EDT 2025
AuthScheme=Basic
User=myUser
Password=myPassword
Security Token=myToken

The configuration tool handles these settings automatically. Each saved configuration enables Claude to launch a dedicated MCP Server instance with the correct connector and options — no manual file editing required.

Connecting to Microsoft Power BI XMLA

Establishing a connection to Microsoft Power BI XMLA involves three main steps:

  1. Select the appropriate authentication method based on your environment.
  2. Configure the required connection properties (such as tokens, secrets, or certificates).
  3. Set the target Power BI workspace.

Important: Only workspaces that are hosted in a Power BI Premium capacity are supported. If the workspace does not have Premium capacity, the connection will fail. To verify this in Power BI, open the workspace in your browser and look for a diamond icon next to the workspace name. This is a built-in indicator in the Power BI user interface that identifies workspaces backed by Premium capacity. If the icon is missing, the workspace is not compatible for XMLA connectivity. For more details, see Which Power BI license do I have?

Step 1: Selecting an Authentication Method

Set the AuthScheme property to select the authentication flow that matches your deployment scenario. Supported values include:

  • AzureAD – For interactive, user-based login flows.
    • Best suited for desktop applications, development environments, or scenarios where users authenticate through a browser.
    • Supports an embedded OAuth application for simplified setup. However, use a custom app instead if your organization requires advanced security policies or if you're deploying a web-based solution, which requires a registered redirect URI.
    • To register a custom OAuth application for this authentication method, see Creating an Entra ID Application (Formerly Azure AD).
  • AzureServicePrincipal – For headless, service-to-service authentication using a client ID and secret.
  • AzureServicePrincipalCert – For certificate-based authentication in secure or regulated environments.

Note: The Power BI workspace and the registered service principal must belong to the same Microsoft Entra tenant. XMLA connections do not support cross-tenant access.

Step 2: Configure Required Connection Properties

After setting AuthScheme, set the connection properties required for your selected authentication method. These properties allow the driver to authenticate securely and request access tokens from Microsoft Entra ID (formerly Azure Active Directory). The exact set of properties vary depending on whether you are using an embedded or custom OAuth application, and whether you're authenticating with user credentials, a client secret, or a certificate.

Note: The Microsoft Power BI XMLA API requires Application permissions to be assigned in Microsoft Entra ID. Delegated permissions are not supported. For a list of required permissions and endpoint domains, see OAuth Permissions and Endpoints.

Step 3: Set the Target Workspace

After authentication is configured, set the Workspace property to specify the Microsoft Power BI workspace you want to connect to. Only workspaces that are hosted in a Power BI Premium capacity are supported. If the workspace does not have Premium capacity, the connection will fail.

You can verify workspace capacity by opening the workspace in Power BI. Look for a diamond icon next to the workspace name. This indicates that the workspace is backed by Premium capacity.

For more details, see Which Power BI license do I have?

Important: If you are authenticating with a service principal, it must be assigned the Admin role in the target workspace. Viewer access is not sufficient for XMLA connectivity.

Authentication with Azure AD

Note: Microsoft Entra ID was formerly known as Azure Active Directory (Azure AD). To authenticate using Entra ID, you must set AuthScheme to AzureAD.

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Microsoft Power BI XMLA endpoints securely.

Authentication to Entra ID via a web application always requires a custom OAuth application registration. This allows your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to register a custom OAuth application, see Creating an Entra ID Application (Formerly Azure AD).

After setting AuthScheme to AzureAD, the steps to authenticate vary by environment. See the sections below for details on how to connect from desktop applications, web-based workflows, or headless systems.

Desktop Applications

You can authenticate from a desktop application using either the driver's embedded OAuth application or a custom OAuth application registered in Microsoft Entra ID.

Option 1: Use the Embedded OAuth Application

This is a pre-registered app included with the driver. It simplifies setup and eliminates the need to register your own credentials and is ideal for development environments, single-user tools, or any setup where quick and easy authentication is preferred.

Set the following connection properties:

  • AuthScheme: AzureAD
  • InitiateOAuth:
    • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
    • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.

When you connect, the driver opens the Microsoft Entra sign-in page in your default browser. After signing in and granting access, the driver retrieves the access and refresh tokens and saves them to the path specified by OAuthSettingsLocation.

Option 2: Use a Custom OAuth Application

If your organization requires more control, such as managing security policies, redirect URIs, or application branding, you can instead register a custom OAuth application in Microsoft Entra ID and provide its values during connection.

Before you begin: Register a custom OAuth application in the Azure portal. During registration, record the following values:

  • OAuthClientId: The client Id generated when registering your custom OAuth application.
  • OAuthClientSecret: The client secret generated when registering your custom OAuth application.
  • CallbackURL: A redirect URI you defined during app registration.

For full instructions on how to register a custom OAuth app and configure redirect URIs, see Creating an Entra ID Application (Formerly Azure AD).

Set the following connection properties:

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Web Applications

To authenticate from a web application, you must register a custom OAuth application in Microsoft Entra ID (formerly Azure Active Directory). Embedded OAuth apps are not supported in this context because web-based flows require a registered redirect URI and centralized credential management.

This approach is designed for hosted, multi-user environments where access must be delegated through a secure, standards-compliant OAuth workflow. It gives your organization control over the OAuth client, redirect URI, branding, and permissions scope.

Before you begin: Register a custom OAuth app in the Azure portal. During registration, collect the following values:

  • OAuthClientId: The client Id generated when registering your custom OAuth application.
  • OAuthClientSecret: The client secret generated when registering your custom OAuth application.
  • CallbackURL: A redirect URI you defined during app registration.

For full instructions on how to register a custom OAuth app and configure redirect URIs, see Creating an Entra ID Application (Formerly Azure AD).

To authenticate using AzureAD in a web application, configure the following connection properties:

Because web applications typically manage OAuth flows manually on the server-side, InitiateOAuth must be set to OFF. This allows you to explicitly control when and how tokens are retrieved and exchanged using stored procedures.

After configuring these properties, follow the steps below to obtain and exchange OAuth tokens:

  1. Call the GetOAuthAuthorizationUrl stored procedure:
    • CallbackURL: Set to your registered redirect URI
  2. Open the returned URL in a browser. Sign in with a Microsoft Entra ID account and grant access.
  3. After signing in, you are redirected to your CallbackURL with a code parameter in the query string.
  4. Extract the code and pass it to the GetOAuthAccessToken stored procedure:
    • AuthMode: WEB
    • Verifier: The authorization code from the CallbackURL
  5. The procedure returns:
    • OAuthAccessToken: Used for authentication.
    • OAuthRefreshToken: Used to refresh the access token.
    • ExpiresIn: The lifetime of the access token in seconds.

To enable automatic token refresh, configure the following connection properties:

When InitiateOAuth is set to REFRESH, the driver uses the provided refresh token to request a new access token automatically.

After a successful connection, the driver saves the updated access and refresh tokens to the file specified by OAuthSettingsLocation.

You only need to repeat the full OAuth authorization flow if the refresh token expires, is revoked, or becomes invalid.

For more background on OAuth flows in Microsoft Entra ID, see Microsoft Entra Authentication Overview.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

You have two setup options:

  • Option 1: Obtain and exchange a verifier code
    • Use another device to sign in and retrieve a verifier code, which the headless system uses to request tokens.
  • Option 2: Transfer an OAuth settings file
    • Authenticate on another device, then copy the stored token file to the headless environment.

Option 1: Using a Verifier Code

  1. On a device with a browser:
    • If using a custom OAuth app, set the following properties:
    • Call the GetOAuthAuthorizationUrl stored procedure to generate a sign-in URL.
    • Open the returned URL in a browser. Sign in and grant grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
    • After signing in, save the value of the code parameter from the redirect URL. You will use this later to set the OAuthVerifier connection property.
  2. On the headless machine:
    • Set the following properties:
    • After tokens are saved, reuse them by setting:
      • InitiateOAuth: REFRESH
      • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
      • For custom apps:
        • OAuthClientId: The client Id generated when registering your custom OAuth application.
        • OAuthClientSecret: The client secret generated when registering your custom OAuth application.

Option 2: Transfer OAuth Settings

  1. On a device with a browser:
    • Connect using the instructions in the Desktop Applications section.
    • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

  2. On the headless machine:
    • Copy the OAuth settings file to the machine.
    • Set the following properties:
      • AuthScheme: AzureAD
      • InitiateOAuth: REFRESH
      • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
      • For custom apps:
        • OAuthClientId: The client Id generated when registering your custom OAuth application.
        • OAuthClientSecret: The client secret generated when registering your custom OAuth application.

After setup, the driver uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

Service principals are security objects within a Microsoft Entra ID application (formerly Azure Active Directory) that define what that application can do within a specific tenant. Service principals are created in the Entra admin center, also accessible through the Azure portal. As part of the creation process we also specify whether the service principal will access Microsoft Entra resources via a client secret or a certificate.

Instead of being tied to a particular user, service principal permissions are based on the roles assigned to them. These roles determine which resources the application can access and which operations it can perform.

When authenticating using a service principal, you must register an application with a Microsoft Entra tenant, as described in Creating a Service Principal Application in Microsoft Entra ID.

You are ready to connect after setting the properties described in this subsection. These vary, depending on whether you will authenticate via a client secret or a certificate.

Authentication with Client Secret

Authentication with Certificate

Troubleshooting Connection Issues

If authentication succeeds but data isn't returned, or if you encounter errors when trying to access metadata or workspaces, check the following:

Blank Dataset Previews or No Tables Returned

  • Ensure your AzureTenant value is correct — it must match the tenant ID (GUID or verified domain) where your Power BI workspace resides.
  • Confirm that the Power BI workspace is backed by a Premium capacity. Non-premium workspaces are not accessible over the XMLA endpoint.
  • If using a Service Principal, it must be assigned as an admin to the workspace. Viewer or Contributor roles are not sufficient.

OAuth Token Refresh Issues

  • If you receive token expiration errors, confirm that InitiateOAuth is set to REFRESH after the initial token exchange.
  • Check that OAuthSettingsLocation points to a file the driver can read and write, especially in headless environments.
  • Refresh tokens may expire or be revoked; if this occurs, you must repeat the full OAuth flow.

Missing Admin Consent or Misconfigured Permissions

  • Review your application's permissions under API Permissions in the Entra admin center.
  • If your app uses Application permissions, an administrator must grant tenant-wide consent.
  • Missing permissions (Dataset.Read.All) or incorrect permission types (Delegated vs. Application) can cause silent failures.

AzureTenant Issues

  • If the tenant ID is missing or incorrect, authentication may succeed but no data will be available.
  • You can use either the GUID or the verified domain name of the tenant, but they must match the tenant where your workspace is hosted.

Delays in Permission Propagation

  • After assigning a role (for example, Service Principal access to a workspace), it may take several minutes for permissions to propagate.
  • If your app was just registered or updated, wait a few minutes and retry the connection.

Copyright (c) 2025 CData Software, Inc. - All rights reserved.
Build 24.0.9300