Fabric Tenant Inventory PowerShell Module

A comprehensive PowerShell module for inventorying Microsoft Fabric and Power BI tenants. Retrieve detailed information about workspaces, capacities, datasets, reports, dashboards, dataflows, gateways, users, permissions, refresh status, and activity logs.

Features

• Complete Tenant Inventory: One command to inventory all resources
• Granular Control: Individual cmdlets for each resource type
• Scanner API Integration: Comprehensive metadata including lineage and datasources
• Flexible Authentication: Interactive user login or service principal for automation
• Multiple Export Formats: CSV, JSON, Excel, and HTML
• Pagination Handling: Automatically handles large tenants with thousands of workspaces
• Error Resilience: Automatic retry with exponential backoff for transient failures
• Progress Indicators: Real-time feedback for long-running operations

Requirements

• PowerShell: 7.0 or later
• Required Module: MicrosoftPowerBIMgmt (v1.2.1111 or later)
• Optional Module: ImportExcel (for Excel export)
• Permissions: Power BI Administrator or Fabric Administrator role

Installation

1. Install Required Module

Install-Module -Name MicrosoftPowerBIMgmt -Scope CurrentUser

2. Install Optional Module (for Excel export)

Install-Module -Name ImportExcel -Scope CurrentUser

3. Import the FabricTenantInventory Module

# Navigate to the module directory
cd "C:\Path\To\FabricTenantInventory"

# Import the module
Import-Module .\FabricTenantInventory.psd1

Quick Start

Basic Tenant Inventory

# Connect to your tenant
Connect-FabricTenant

# Get complete inventory
$inventory = Get-FabricInventory

# View summary
$inventory.Summary

# Disconnect when done
Disconnect-FabricTenant

Export to JSON

Connect-FabricTenant

$inventory = Get-FabricInventory

Export-FabricInventory -InputObject $inventory -Path "C:\Inventory\tenant.json" -Format JSON

Disconnect-FabricTenant

Authentication

Interactive User Authentication

# Opens browser for authentication
Connect-FabricTenant

PIM (Privileged Identity Management) Role Activation

If you have an eligible Fabric Administrator role via PIM, you can activate it automatically when connecting:

Automatic Activation During Connection

# Activate PIM role and connect in one command
Connect-FabricTenant -ActivatePIMRole -PIMJustification "Quarterly tenant inventory"

# Specify custom duration (default is 8 hours)
Connect-FabricTenant -ActivatePIMRole -PIMJustification "Emergency audit" -PIMDurationHours 4

Manual PIM Role Activation

# Check if you have eligible Fabric Administrator role
Enable-FabricAdministratorRole -CheckOnly

# Activate the role manually
Enable-FabricAdministratorRole -Justification "Monthly compliance review" -DurationHours 8

# Then connect
Connect-FabricTenant

PIM Prerequisites

1. Eligible Role Assignment: You must have an eligible Fabric Administrator role in Entra ID

2. Microsoft Graph Authentication: One of the following must be available:

   • Microsoft.Graph PowerShell module: Install-Module Microsoft.Graph -Scope CurrentUser
   • Az.Accounts module: Install-Module Az.Accounts -Scope CurrentUser
   • Azure CLI: az login

3. Authenticate to Microsoft Graph (choose one method):

   # Method 1: Microsoft.Graph module
   Install-Module Microsoft.Graph -Scope CurrentUser
   Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
   
   # Method 2: Az.Accounts module
   Install-Module Az.Accounts -Scope CurrentUser
   Connect-AzAccount
   
   # Method 3: Azure CLI
   az login

4. Run PIM activation:

# Now activate your PIM role
Connect-FabricTenant -ActivatePIMRole -PIMJustification "Tenant inventory"

Fallback: Manual Portal Activation

If automatic PIM activation fails, you can activate manually:

1. Open Azure Portal - PIM
2. Find "Fabric Administrator" role
3. Click "Activate"
4. Provide justification and duration
5. Click "Activate"
6. Wait ~30 seconds for activation to propagate
7. Run Connect-FabricTenant (without -ActivatePIMRole)

Service Principal Authentication

# Create credentials (Client ID as username, Secret as password)
$clientId = "12345678-1234-1234-1234-123456789012"
$clientSecret = ConvertTo-SecureString "your-client-secret" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $clientSecret)

# Connect
Connect-FabricTenant -ServicePrincipal -TenantId "contoso.onmicrosoft.com" -Credential $credential

Service Principal Setup

1. Register an Azure AD App in Azure Portal
2. Grant API permissions:
   • Power BI Service: Tenant.Read.All, Workspace.Read.All
3. Add app to Power BI Admin group or grant Fabric Administrator role
4. Create a client secret

Usage Examples

Get All Workspaces

$workspaces = Get-FabricWorkspace
$workspaces | Select-Object Name, State, IsOnDedicatedCapacity

Get Workspaces on Specific Capacity

$capacityId = "12345678-1234-1234-1234-123456789012"
$workspaces = Get-FabricWorkspace -CapacityId $capacityId -State Active

Get All Datasets with Datasources

$datasets = Get-FabricDataset -IncludeDataSources
$datasets | Select-Object Name, WorkspaceId, IsRefreshable

Get Reports in Specific Workspace

$workspaceId = "12345678-1234-1234-1234-123456789012"
$reports = Get-FabricReport -WorkspaceId $workspaceId

Get Refresh History for Dataset

$workspaceId = "workspace-id"
$datasetId = "dataset-id"
$refreshes = Get-FabricRefreshHistory -WorkspaceId $workspaceId -DatasetId $datasetId -Top 50

# Show failed refreshes
$refreshes | Where-Object { $_.status -eq 'Failed' } | Select-Object startTime, endTime, status

Get Activity Logs (Last 7 Days)

$startDate = (Get-Date).AddDays(-7)
$activities = Get-FabricActivityLog -StartDateTime $startDate

# Most viewed reports
$activities | Where-Object Activity -eq 'ViewReport' | Group-Object ReportId | Sort-Object Count -Descending | Select-Object -First 10

Get User Permissions Across Tenant

$users = Get-FabricUser

# Find specific user's access
$users | Where-Object UserPrincipalName -like "*john.doe@contoso.com*"

Scanner API - Comprehensive Metadata

# Get workspace IDs
$workspaceIds = (Get-FabricWorkspace -State Active | Select-Object -First 10).Id

# Run scanner with datasources and schema
$scanResult = Invoke-FabricScanner -WorkspaceIds $workspaceIds -Datasources -DatasetSchema

# Explore results
$scanResult.Summary
$scanResult.Datasets | Select-Object name, isRefreshable, configuredBy

Custom Inventory (Specific Resources)

# Only get workspaces and datasets
$inventory = Get-FabricInventory `
    -IncludeWorkspaces $true `
    -IncludeCapacities $false `
    -IncludeDatasets $true `
    -IncludeReports $false `
    -IncludeDashboards $false `
    -IncludeDataflows $false `
    -IncludeGateways $false `
    -IncludeUsers $false

Export to Multiple Formats

$inventory = Get-FabricInventory

# Export to JSON
Export-FabricInventory -InputObject $inventory -Path "inventory.json" -Format JSON

# Export to CSV (split by resource type)
Export-FabricInventory -InputObject $inventory -Path "C:\Inventory" -Format CSV -Split

# Export to Excel (requires ImportExcel module)
Export-FabricInventory -InputObject $inventory -Path "inventory.xlsx" -Format Excel -Split

Compliance Reporting

# Find datasets without sensitivity labels
$datasets = Get-FabricDataset
$unlabeled = $datasets | Where-Object { -not $_.SensitivityLabel }

# Find uncertified datasets in production
$workspaces = Get-FabricWorkspace -Name "*Prod*"
$prodDatasets = Get-FabricDataset -WorkspaceId $workspaces.Id
$uncertified = $prodDatasets | Where-Object { $_.Endorsement.EndorsementStatus -ne 'Certified' }

# Export for review
$uncertified | Export-FabricInventory -Path "uncertified_datasets.csv" -Format CSV

Tenant Assessment & Reporting

Best Practice Assessment

Automatically assess your tenant against security and governance best practices:

# Run inventory with assessment
$inventory = Get-FabricInventory -RunAssessment

# View findings by severity
$inventory.Assessment.Findings.Critical  # Critical issues
$inventory.Assessment.Findings.High      # High priority issues

Statistical Reporting with Health Scores

Generate comprehensive HTML reports:

# Complete assessment with reporting
$inventory = Get-FabricInventory `
    -IncludeActivityLogs -ActivityLogDays 90 `
    -RunAssessment `
    -GenerateReport `
    -ReportPath "C:\Reports\TenantHealth.html"

# View health score (0-100)
$inventory.Report.Health.OverallScore

Assessment Categories

• Security: Public sharing, external access, export permissions
• Governance: Sensitivity labels, certification, endorsement
• Operations: Refresh failures, single points of failure
• Compliance: Unused resources, permission sprawl

See Examples/AssessmentAndReporting.ps1 for complete examples.

Cmdlet Reference

Cmdlet	Description
Connect-FabricTenant	Authenticate to Fabric/Power BI tenant (supports PIM role activation)
Disconnect-FabricTenant	Disconnect and clear session
Enable-FabricAdministratorRole	Activate eligible Fabric Administrator PIM role in Entra ID
Get-FabricInventory	Complete tenant inventory with optional assessment and reporting
Get-FabricTenantSettings	Retrieve tenant-level settings and configurations
Invoke-FabricAssessment	Assess tenant against best practices and identify issues
New-FabricTenantReport	Generate statistical report with health scores and top 10 lists
Get-FabricWorkspace	Retrieve workspace details
Get-FabricCapacity	Retrieve capacity information
Get-FabricDataset	Retrieve dataset/semantic model metadata
Get-FabricReport	Retrieve report information
Get-FabricDashboard	Retrieve dashboard details
Get-FabricDataflow	Retrieve dataflow information
Get-FabricGateway	Retrieve gateway configuration
Get-FabricUser	Aggregate user permissions
Get-FabricRefreshHistory	Retrieve dataset refresh history
Get-FabricActivityLog	Retrieve activity/audit logs
Invoke-FabricScanner	Execute Scanner API for comprehensive metadata
Export-FabricInventory	Export inventory to CSV/JSON/Excel/HTML

Configuration

Configuration is stored in FabricTenantInventory\Config\default-config.json. Key settings:

• RetryAttempts: Number of retries for failed API calls (default: 3)
• RetryDelaySeconds: Initial delay between retries (default: 5)
• ScannerAPIMaxWorkspaces: Max workspaces per Scanner API request (default: 100)
• ScannerAPITimeoutSeconds: Scanner API timeout (default: 600)
• ActivityLogDaysPerRequest: Days per activity log request (default: 1, max: 30)

PIM Role Activation Details

Authentication Methods (Automatic Fallback)

The Enable-FabricAdministratorRole cmdlet automatically tries multiple authentication methods:

1. Microsoft.Graph module (preferred)
2. Az.Accounts module (fallback)
3. Azure CLI (fallback)

No need to specify which method - it will try all available methods automatically.

Manual Activation Fallback

If automatic activation fails, the cmdlet provides step-by-step instructions for:

1. Azure Portal: Direct link to PIM activation page
2. Required permissions: RoleManagement.ReadWrite.Directory
3. Prerequisites check: Verifies eligible role assignment

Common PIM Scenarios

Scenario 1: First Time Setup

# Install Graph module
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect to Graph
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

# Activate PIM role and connect to Fabric
Connect-FabricTenant -ActivatePIMRole -PIMJustification "Initial setup"

Scenario 2: Daily Use with Existing Graph Session

# If already connected to Microsoft Graph
Connect-FabricTenant -ActivatePIMRole -PIMJustification "Daily inventory"

Scenario 3: Automation (Service Principal - No PIM)

# Service principals don't use PIM
$cred = Get-Credential
Connect-FabricTenant -ServicePrincipal -TenantId "contoso.onmicrosoft.com" -Credential $cred

Troubleshooting

"Not authenticated" Error

# Ensure you're connected
Connect-FabricTenant

# Verify connection
$script:FabricConnection

Rate Limiting (HTTP 429)

The module automatically retries with exponential backoff. For large tenants:

# Batch workspace scans
$workspaces = Get-FabricWorkspace
$batches = 0..($workspaces.Count / 100) | ForEach-Object {
    $workspaces[($_ * 100)..([Math]::Min(($_ + 1) * 100 - 1, $workspaces.Count - 1))]
}

foreach ($batch in $batches) {
    Invoke-FabricScanner -WorkspaceIds $batch.Id
    Start-Sleep -Seconds 60  # Pause between batches
}

Insufficient Permissions (HTTP 403)

Ensure your account or service principal has:

• Power BI Administrator or Fabric Administrator role
• API permissions: Tenant.Read.All, Workspace.Read.All

Scanner API Timeout

For very large workspaces, increase timeout:

# Edit config file
$configPath = ".\FabricTenantInventory\Config\default-config.json"
$config = Get-Content $configPath | ConvertFrom-Json
$config.ScannerAPITimeoutSeconds = 1200  # 20 minutes
$config | ConvertTo-Json | Set-Content $configPath

ImportExcel Module Not Found

# Install the module
Install-Module -Name ImportExcel -Scope CurrentUser

# Or export to CSV instead
Export-FabricInventory -InputObject $inventory -Path "inventory.csv" -Format CSV

PIM Role Activation Issues

No Eligible Role Found

# Check your PIM role assignments
Enable-FabricAdministratorRole -CheckOnly

# If no role found:
# 1. Request Fabric Administrator role from your admin
# 2. Verify in Azure Portal: Entra ID > Roles and administrators > Fabric Administrator > Eligible assignments

Microsoft Graph Authentication Failed

# Install and connect to Microsoft Graph
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

# Verify connection
Get-MgContext

# Try activation again
Enable-FabricAdministratorRole -Justification "Tenant inventory"

PIM Activation Timeout or Pending

If activation appears to hang:

1. PIM policies may require approval
2. Check Azure Portal for pending activation requests
3. Contact your admin to approve or adjust PIM policy
4. Use manual portal activation as fallback

Already Activated

If role is already active:

# The cmdlet will detect this and inform you
Enable-FabricAdministratorRole -Justification "Check status"
# Output: "Role already active! Activated at: [time]"

Best Practices

1. Use Service Principal for Automation: Schedule regular inventories using service principal authentication
2. Batch Large Operations: For tenants with 1,000+ workspaces, batch Scanner API calls
3. Monitor Refresh Failures: Regularly check refresh history for critical datasets
4. Track Activity Logs: Archive activity logs monthly for compliance
5. Export Regularly: Keep historical snapshots for trend analysis

Performance

• Small tenant (< 100 workspaces): ~2-5 minutes
• Medium tenant (100-500 workspaces): ~5-15 minutes
• Large tenant (500-2,000 workspaces): ~15-45 minutes
• Very large tenant (> 2,000 workspaces): 45+ minutes

Scanner API is the primary bottleneck for large tenants. Use -IncludeDatasets $false to skip Scanner API if only workspace/capacity inventory is needed.

Contributing

This module is under active development. Feedback and contributions welcome!

License

This project is licensed under the MIT License - see the LICENSE file for details.

Version History

0.1.0 (2026-01-25)

• Initial pre-release version
• Note: This version is untested and intended for early feedback and testing
• Full tenant inventory support
• Scanner API integration
• Multiple export formats
• Interactive and service principal authentication
• PIM (Privileged Identity Management) role activation support
• Automatic Microsoft Graph authentication with multiple fallback methods
• Comprehensive error handling with manual fallback instructions
• Tenant settings inventory and governance assessment
• Best practice analysis with severity ratings (Critical/High/Medium/Low/Info)
• Automated identification of security risks and compliance issues
• Statistical reporting with health scores and top 10 lists
• HTML report generation with interactive visualizations
• Foreign key relationships across all data types for lineage tracking

Support

For issues, questions, or feature requests, please open an issue on the GitHub repository.

Author

Created by Klaas Vandenberghe ( @PowerDBAKlaas )