skills.rest
InsightfulAnalytics
InsightfulAnalyticsCOMMUNITY
Explore all skills by this author →
GitHub

audit-tenant-settings

Audit Fabric and Power BI tenant settings against a curated baseline and report drift.

6|3|Updated Jul 4, 2026
Search Tags:#drift detection#audit#governance#fabric#power bi#security groups#tenant settings
One-click install
npx skills add https://github.com/InsightfulAnalytics/PBI_Agentic_Dev --skill audit-tenant-settings-insightfulanalytics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-tenant-settings
Source: https://github.com/InsightfulAnalytics/PBI_Agentic_Dev/tree/main/plugins/fabric-admin/skills/audit-tenant-settings
Command: npx skills add https://github.com/InsightfulAnalytics/PBI_Agentic_Dev --skill audit-tenant-settings-insightfulanalytics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, reportlab, and includes scripts (resource) and references (resource) components.

What problem does it solve? Fabric and Power BI tenant settings sprawl across dozens of toggles, delegated overrides, and security-group scopes, making it hard for administrators to know whether the live tenant posture matches governance intent or has drifted over time. ## Core Features & Use Cases - Baseline Drift Audit: Fetches live tenant settings via the fab CLI, merges them with a curated metadata baseline, and renders a markdown report with compliance status, risk levels, and change detection against the previous snapshot. - Delegated Override Enumeration: Enumerates capacity, domain, and workspace overrides and classifies each as drift-vs-tenant, drift-vs-recommended, high-risk, or orphan. - Security Group Investigation: Resolves Entra security groups referenced by settings via az CLI and Microsoft Graph, flagging empty groups, guest members, stale owners, and dynamic membership risks. - PDF Briefing: Generates a one-to-two-page stakeholder PDF with headline counts, changes since last audit, and the drift table. - Use Case: A Fabric admin runs a monthly governance review, detects that PublishToWeb was toggled on since the last snapshot, sees which security groups scope high-risk settings, and shares the PDF summary with stakeholders. ## Quick Start Ask the agent to run a tenant governance audit of my Fabric tenant settings and show any drift from the recommended baseline.

Frequently Asked Questions about audit-tenant-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Fabric tenant settings for configuration drift?▼

Run the bundled audit script with uv run scripts/audit-tenant-settings.py, which fetches live settings via fab api admin/tenantsettings and compares them against the curated metadata baseline. It renders a markdown report with compliance status, risk levels, and a drift table.

How to detect changes in Power BI tenant settings over time?▼

The audit script saves a snapshot JSON after each run and diffs subsequent runs against it, reporting added, removed, toggled, security-group, and property changes. Use --no-snapshot to skip change detection or --snapshot to isolate per-tenant snapshots.

What permissions are required to audit Fabric tenant settings?▼

You need the fab CLI authenticated with a Fabric or Power BI admin account, verified via fab auth status and a test call to admin/capacities. For security group investigation, az CLI must be logged in with Group.Read.All, User.Read.All, Directory.Read.All, and RoleManagement.Read.Directory.

Can I change tenant settings or delegated overrides through the API?▼

Only capacity overrides support Update and Delete through the Fabric admin REST API; domain and workspace overrides must be changed in the admin portal UI. The skill never applies writes automatically and requires explicit user confirmation before any change.

Why does enabling a tenant setting return a bare 400 error?▼

Some settings with canSpecifySecurityGroups set to true require a group scope and reject an org-wide enable with a bare 400. Add enabledSecurityGroups to the request body before suspecting permissions or a malformed payload.

Does the audit work on large tenants with many workspaces?▼

Yes, but admin workspace and override endpoints are paged, so you must follow continuationUri or continuationToken and stream results rather than materializing everything. Admin write endpoints are also rate-limited to 25 requests per minute, so honor Retry-After on 429 responses.

Related Skills

Explore More Data & Analytics Skills→
data-goblindata-goblin
887

audit-tenant-settings

Audit Fabric and Power BI tenant settings against a curated baseline and report drift.

Community
Advanced
Bitterbot-AIBitterbot-AI
2.5k

model-usage

Aggregate per-model CodexBar costs from local JSON logs into text or JSON summaries.

Official
Intermediate
m2ai-portfoliom2ai-portfolio
4

trust-score

Score AI-generated artifacts on a 0–100 trust scale across five dimensions.

Official
Advanced
aristoteleoaristoteleo
478

Gene Panel Selection Workflow

Develop and evaluate gene panels for single-cell analyses with ARI/NMI/SI benchmarking.

Official
Advanced