Organization
BI Connectivity
BI Connectivity publishes saved queries as OData feeds that Power BI (and other OData-compatible BI tools) can connect to directly — with row-level security, a semantic layer, and optional per-user delegation on top.
Connect Power BI
- 1
Create an API key
Under API Access, create a key with the BI Read and BI Metadata scopes.
- 2
Point Power BI at the service root
In Power BI Desktop, choose Get Data → OData Feed and paste the OData service root URL.
- 3
Set authentication
Pick Web API as the auth method and set the header key X-API-Key to your API key. Basic or Anonymous with a custom header also works.
- 4
Enable incremental refresh (optional)
For large datasets, filter on a date/time column so Power BI only reloads changed rows. Open a dataset's View details to see its suggested watermark column.
Publishing a dataset
Every dataset published to BI tools starts from an existing saved query. Click Publish dataset and fill in:
Name / SlugSlug is used in the OData URL — lowercase letters, numbers, and underscores only, 3–64 characters.Saved queryThe query whose result set this dataset serves. Every published dataset is backed by a saved query.Max rows (optional)Caps the number of rows served per request.Internal onlyRestricts the dataset to internal consumers.Pre-warmRefreshes a snapshot on a schedule so the first page load is instant instead of running the query cold.Once published, each dataset gets its own OData feed URL, and you can enable or disable it, view its schema, or delete it at any time from the list.
Row-level security
RLS on a BI dataset works in two parts — a rule defined on the dataset, and a value bound to the credential reading it:
Dataset RLS policyRules of the form column = principal.attribute (or "in" for a list), defined per dataset. A dataset with rules denies any credential that doesn't have a matching attribute bound to it.Credential accessBind attribute values to a specific API key or OAuth client — this is where a rule like region = principal.region gets its actual value for that credential.For example, a rule of region = principal.region on a dataset means every credential reading it needs a region attribute bound under Credential access — otherwise it's denied.
Semantic layer
Beyond raw columns, each dataset can define richer structure that BI tools pick up automatically:
Measures
Named server-side aggregates (sum, average, min, max, distinct count, or row count) that BI tools can reference by name instead of re-deriving them client-side.
Dimensions
Named, groupable column hierarchies surfaced in $metadata — lets Power BI present a cleaner grouping structure than raw columns.
Relationships
Foreign keys to other published datasets, with a cardinality (to-one or to-many) — Power BI uses these to auto-build a star schema across your datasets.
Known values
A declared list of the actual values a column contains (e.g. OPEN, PAID, VOID for a status column). This helps AI-generated queries filter on the correct literal instead of guessing — and nothing is read from your data to populate it; only what you type here is used.
On-behalf-of delegation
By default, row-level security is scoped per credential (an API key or OAuth client) — every user of that credential sees the same rows. Delegation lets a trusted app instead filter rows per end user: it sends its own credential plus a signed user assertion, and NNIPA verifies that assertion and maps its claims to RLS attributes.
Issuer / AudienceThe expected iss (and optionally aud) claim on the incoming user token.AlgorithmRS256 (public key, verified via OIDC discovery, a JWKS URL, or a static PEM) or HS256 (shared secret).Subject claimWhich claim identifies the end user — defaults to sub.Claim mappingsMaps a JWT claim to an RLS principal attribute, e.g. region → region.Native SSO (optional)Lets Power BI's Organizational account option authenticate with only an Entra token — no API key needed. Requires at least one granted scope, and can optionally restrict which datasets and columns an SSO principal can see.Without delegation configured, all reads use credential-level row scoping — this is a purely additive feature, not a requirement to get started.
- Known values (in the semantic layer) never sample your actual data — the platform only ever uses the exact values you type in.
- Removing a credential's RLS binding immediately blocks it from any dataset that has an RLS policy, until it's re-bound.
- Disabling delegation doesn't affect credential-level RLS — only on-behalf-of reads stop working.
- A dataset can only have one Known values entry per column — the editor won't let you pick a column that already has one.