Table of contents
Overview
Fugo's Power BI app integrates directly with the Microsoft Power BI REST API to display live dashboards and reports on digital signage screens.
Unlike browser-based dashboard embedding, the Power BI app establishes a delegated OAuth connection to the customer's Microsoft Entra ID tenant. This allows Fugo to discover the Power BI workspaces, reports, dashboards and datasets that the authenticated user already has permission to access, while continuing to enforce Microsoft's existing authorization model.
Authentication is performed entirely by Microsoft. Fugo never collects or stores Microsoft passwords. Following authentication, Fugo stores the Microsoft account identifier (for example, the user's email address) along with the OAuth tokens issued by Microsoft so the connection can be maintained.
👉 For instructions for configuring the Power BI app in Fugo CMS, see this guide.
Authentication flow
The integration uses Microsoft's OAuth 2.0 Authorization Code Flow.
When a user clicks Authorize in the Power BI app:
Fugo redirects the user to Microsoft's secure sign-in page.
Microsoft authenticates the user against Microsoft Entra ID.
Microsoft displays the permissions requested by the Fugo application.
The user (or a Microsoft Entra administrator, if required by tenant policy) grants consent.
Microsoft issues OAuth access and refresh tokens.
Fugo uses those delegated tokens to communicate with the Power BI REST API on behalf of the authenticated user.
No Microsoft passwords are ever transmitted through or stored by Fugo. Authentication takes place entirely on Microsoft's sign-in pages. Following a successful sign-in, Fugo stores the OAuth tokens issued by Microsoft and the connected account's identifier so the integration can continue accessing the Power BI resources you authorized.
Microsoft Entra Enterprise Application
The first successful authorization creates a Service Principal (Enterprise Application) for Fugo CMS within your Microsoft Entra tenant.
Administrators can manage the application from:
Microsoft Entra Admin Center → Enterprise Applications → Fugo CMS
From there administrators can:
Review API permissions
Grant or revoke tenant-wide admin consent
Review sign-in activity
Apply Conditional Access policies
Remove the Enterprise Application from the tenant
Removing the Enterprise Application revokes Fugo's ability to authenticate against that tenant until authorization is completed again.
This is standard Microsoft OAuth behaviour for multi-tenant SaaS applications.
Delegated API permissions
Fugo authenticates using delegated permissions, not application permissions. This means Fugo acts only on behalf of the authenticated user and can never access Power BI resources that the user themselves cannot access.
The Power BI integration requests the following delegated permissions.
Power BI Service permissions
Permission | Purpose |
Dashboard.Read.All | Read dashboards available to the authenticated user. |
Report.Read.All | Read reports available to the authenticated user. |
Workspace.Read.All | Enumerate Power BI workspaces the authenticated user can access. |
Dataset.Read.All | Read datasets associated with reports and dashboards (required for features such as report slicers). |
Microsoft Graph permissions
Permission | Purpose |
User.Read | Identify the authenticated user. |
profile | Retrieve the user's basic profile information. |
Retrieve the user's email address. | |
openid | Complete OpenID Connect authentication. |
offline_access | Allow Microsoft to issue refresh tokens so users don't need to reauthenticate frequently. |
These are all delegated permissions, meaning every request made by Fugo is evaluated using the permissions of the authenticated Microsoft user.
OAuth access tokens issued to Fugo are scoped to these delegated permissions. Fugo cannot request permissions beyond those approved by the user or Microsoft Entra administrator.
What access does Fugo have?
Fugo does not receive tenant-wide administrative access to Microsoft 365 or Power BI.
Using the delegated OAuth tokens issued by Microsoft, the integration can only access:
Power BI workspaces the authenticated user already has permission to view
Dashboards available to that user
Reports available to that user
Associated datasets where permitted by Microsoft
Fugo cannot:
Create or modify Power BI reports or dashboards
Create or modify datasets
Manage Microsoft users
Change Power BI permissions
Access workspaces the authenticated user cannot already access
Bypass Microsoft Entra authentication or authorization policies
All authorization decisions remain under Microsoft's control.
OAuth tokens
Following successful authorization, Microsoft issues OAuth access and refresh tokens.
Fugo securely stores these Microsoft-issued tokens so it can continue reading the Power BI resources you authorized without requiring users to sign in repeatedly.
The refresh token allows Fugo to obtain new access tokens as existing ones expire, enabling dashboards to continue updating automatically 24/7.
Microsoft remains responsible for:
User authentication
Token issuance
Token expiry
Token revocation
Fugo never generates Microsoft authentication tokens or stores Microsoft passwords.
Unlike an interactive web session, digital signage screens are expected to operate continuously for weeks or months without user interaction. Refresh tokens allow Fugo to maintain an authenticated connection so Power BI dashboards continue updating automatically without requiring users to sign in again.
Administrative approval
Depending on your Microsoft Entra configuration, administrator approval may be required before users can authorize third-party applications.
Where administrator approval is required:
A Microsoft Entra administrator signs into the Power BI connection flow.
They grant consent on behalf of the organization.
Users can then authenticate using their own Microsoft accounts.
Alternatively, administrators can grant consent directly from the Permissions page of the Fugo CMS Enterprise Application in Microsoft Entra.
Licensing requirements
The Microsoft account used to connect Power BI must have an appropriate Power BI licence.
Typically this means:
Power BI Pro
Power BI Premium Per User (PPU)
A Microsoft 365 tenant may contain users with different Power BI licence types. Licensing should therefore be verified for the specific user account used to authorize the integration.
Organizations using Microsoft Fabric or Premium Capacity may have different licensing requirements depending on their deployment model.
Security considerations
Fugo follows Microsoft's standard OAuth security model.
Authentication occurs exclusively on Microsoft's hosted sign-in pages.
Microsoft credentials are never handled by Fugo.
All API requests are authenticated using Microsoft-issued OAuth access tokens.
Administrators retain full control over consent, Conditional Access policies and application removal through Microsoft Entra.
Revoking consent or removing the Fugo Enterprise Application in Microsoft Entra immediately prevents Fugo from accessing Power BI resources for that tenant. Existing locally stored tokens become unusable once Microsoft revokes access.
Common troubleshooting
"Admin approval required"
This usually indicates that your Microsoft Entra tenant requires administrator consent before users can authorize third-party applications.
A Microsoft Entra administrator must complete the consent flow before users can connect Power BI.
Generic "Connection error"
Possible causes include:
Administrator consent has not completed successfully.
The connecting user does not have the required Power BI licence.
The connecting user is authenticating against a different Microsoft Entra tenant than the one hosting the Power BI resources.
Required delegated permissions have not been granted.
Microsoft Entra Conditional Access policies are preventing authentication.
Frequently asked questions
Does Fugo store our Microsoft password?
No. Authentication is handled entirely by Microsoft. Fugo never stores Microsoft passwords. To maintain the connection, Fugo securely stores the OAuth tokens issued by Microsoft along with the connected account's identifier.
How are OAuth tokens protected?
OAuth access and refresh tokens are stored securely by Fugo and are used solely to access the Power BI resources authorized by the connected Microsoft account. Tokens cannot be used to access resources outside the delegated permissions granted during the Microsoft consent process.
Can Fugo access every Power BI dashboard in our tenant?
No. Fugo can only access the workspaces, dashboards, reports and datasets that the authenticated user already has permission to access.
Can our IT team revoke access later?
Yes. Administrators can revoke consent, remove the Enterprise Application, or apply Conditional Access policies through Microsoft Entra at any time.
Does Fugo require Global Administrator privileges?
No. Administrator privileges are only required if your Microsoft Entra tenant requires administrator approval for third-party applications. Day-to-day use of the integration does not require administrator permissions.
Can we audit authentication activity?
Yes. Authentication attempts, consent events and application sign-ins can be reviewed through Microsoft Entra's Enterprise Application and Sign-in Logs.