Connect directly to Power BI

Follow these steps in your own Denframe. This website never connects to your household, your accounts or your devices, and never asks for your credentials.

1. 1

   Administrator: prepare Microsoft access

   In Microsoft Entra app registrations, create or select the approved app. Copy its Directory (tenant) ID and Application (client) ID.

   Enable public-client device-code authentication. Add the Power BI Service delegated Dataset.Read.All permission and complete the consent your organization requires. This delegated flow doesn’t use an application client secret.

   Have the Power BI administrator enable Execute Queries for the tenant and give the signing-in user read and build access to the target semantic model. Copy the semantic model’s dataset ID; don’t use a report or workspace ID.

2. 2

   Administrator: set the encryption key

   Generate a Fernet key with the command below, in a Python environment that has the cryptography package. Store it as DENFRAME_POWER_BI_CACHE_KEY in the host’s protected startup environment, separate from its database and backups, then restart Denframe. Without a valid key, Denframe refuses direct sign-in.

   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

   Don’t paste the key into source settings or the website. Keep it stable across restarts: losing or changing it means reconnecting every Power BI source.

3. 3

   Sign in with Microsoft

   In Studio, open Sources, then Custom. Choose Add a custom source; the sheet asks where the data comes from.

   Choose Power BI · Connect directly. Enter Tenant ID and Application (client) ID, keep Microsoft authentication on My Microsoft account, and choose Sign in with Microsoft.

   Open Microsoft device sign-in and enter the code Denframe shows. Enter Microsoft credentials only on Microsoft’s site.

   Back in Denframe, choose I've finished signing in and wait for the sheet to say which account is signed in.

4. 4

   Advanced: service-principal access

   Instead of a person’s account, an app’s own credential can sign in. Before choosing Sign in with Microsoft, select Service principal (advanced) under Microsoft authentication and enter the secret in Application client secret; there is no device code, and the sheet says it is signed in as Service principal. Use it only when your tenant permits it and the model is eligible.

   Models using RLS or SSO are not supported in this mode. Don’t use a manually copied, short-lived access token as a permanent HTTP source credential.

5. 5

   Test a saved query

   Enter Semantic model (dataset) ID and put the synthetic query below in Saved DAX query. Set Check every (seconds) to 900, then choose Test saved query. It should return one row with Revenue 124500 and AttainmentPct 83.

   EVALUATE ROW("Revenue", 124500, "AttainmentPct", 83)

   When ready, replace the constants with your model’s measures, for example EVALUATE ROW("Revenue", [Total Revenue], "AttainmentPct", [Attainment Percent]), and test again. The measure names must exist and the attainment measure must return the intended 0–100 scale.

6. 6

   Map the result

   Edit the first value and choose Add another value for the second, using these paths. Keep the brackets around the returned column names.

   Value	Field path	Settings
   Revenue	/results/0/tables/0/rows/0/[Revenue]	Metric; unit EUR; Hero number
   Attainment	/results/0/tables/0/rows/0/[AttainmentPct]	Range; unit %; 0 to 100; Bars

   Keep Visibility on Private unless the intended audience permits another choice.

7. 7

   Preview and add it to a dashboard

   Choose Preview selected values. Check the values match the query test. Pick the value in Value to show and look at it in both TV 16:9 and Portrait.

   Under Show on, tick an eligible dashboard and choose Add source. If you started from a Custom block selected in Studio, that exact block is updated; otherwise the connection adds a new block.

   To show the second value, add or select another Custom block in Studio and choose this existing source and its other value. The first block keeps its own value.

   A dashboard’s audience must permit the value you attach. Denframe never broadens the audience for you; change it in Studio first if the value is hidden.

8. 8

   Check it worked

   Both blocks show their values on the dashboard. After a host restart, check that updates continue unattended in your test deployment.

   If consent or model access is revoked, Denframe turns the source off. Open the source, choose Edit or reconnect Microsoft, sign in, test and save again; saving turns it back on.