Configuring Azure and Power BI for Premium Per User features

🔧Azure & Power BI Tenant Setup Overview (Managed Reports)

This guide outlines the steps required to configure your Azure and Power BI Tenant for ZoneReporting Managed Reports. These configurations allow our team to complete the setup, enable advanced Power BI capabilities, and integrate with your Managed Data Warehouse.

✅What You Will Do:

1. Create Security Group
   Create a 'ZoneReporting' Security Group and add Client Application to this group.

2. Create User Account
   Create a dedicated user account for ZoneReporting to manage Power BI settings.

3. Assign Group and Roles
   Assign the User and Client Application to the existing ZoneReporting security group with roles.

4. Configure Power BI Tenant Admin Settings
   Enable Fabric APIs and XMLA read/write access to support data model operations.

5. Create a Premium Per User Workspace
   Set up a dedicated Power BI workspace with PPU licensing to host the ZoneReporting data model.

6. Assign Admin Access to the Group
   Grant the security group admin rights to the Power BI workspace.

7. Register ZoneReporting as a Microsoft Partner
   Link your Azure tenant to ZoneReporting so Microsoft recognizes us as your authorized integration and support partner.

Prerequisites:

• ZoneReporting is now only available via the integration and support of the Data Warehouse. Please ensure that the Managed Data Warehouse has been fully configured before moving forward with these instructions. 
• These steps should be completed by an Office 365/Azure administrator. Please reach out to your ZoneReporting implementation team with any questions.

1. Create Security Group

1. Navigate back to the home screen and click Microsoft Entra ID. If you don't see this option type 'Microsoft Entra ID' into the search bar.
   
   
2. In the Microsoft Entra ID portal click Groups from the left-hand menu.
   
   
   
   
3. Click New group, and set the group properties as follows:
   
   
   
   
   • Group Type = Security
   • Group Name = Includes 'ZoneReporting' in the name
   • Group Description = Optional
   • Membership Type = Assigned
4. Under Members, click the blue 'No members selected' link to assign the previously created client application (e.g., ZoneReporting) to the security group. then click Select to save the changes.
   
   
   
   
5. Click Create
6. Copy and paste the Security Group name value into your Azure setup checklist.

2. Create User Account

ZoneReporting requires a user account in your Office 365 directory so we can configure settings in Power BI and perform other setup tasks during implementation. 

1. Navigate to https://portal.azure.com
   • From the home screen, click on Microsoft Entra ID. If you don't see this option, type 'Mircosoft Entra ID' into the search bar.
     
     
     
     
2. Click + Add, then User, followed by Create new user
   
   
   
   
3. Under the Basics tab in the Identity section:
   
   
   
   • User principal name = Includes 'ZR' in the name
   • Mail nickname = Derive from user principal name
   • Display name = same as User principal name
   • Password = Auto-generate password
     
     
4. Copy and paste the User principal name and Password into the Azure setup checklist.

3. Assign Group and role

1. Next Click on the Assignments tab.
2. Click on + Add group
3. Now search for and select the 'ZoneReporting' security group, and click Select
   
4. Next click + Add role
5. Now search for and select the 'Fabric Administrator' Role, and click Select
   
   
   
   
6. Review the following Assignments
   
   
   
   
7. Click Review + create, followed by Create
   
   🪄 Important:
   If multi-factor authentication (MFA) is enabled in your directory, ZoneReporting requires that the method “Verification code from mobile app or hardware token” is available. Please ensure this option is enabled in your MFA settings.
   
   
8. Navigate to Microsoft Entra ID, click Users, and then click Per-user MFA
   
   
   
   
9. Click Service Settings and scroll down until you see Verification options. Make sure Verification code from mobile app or hardware token is selected.
   
   
   

4. Configure Admin Portal settings

1. Navigate to https://app.powerbi.com/admin-portal/tenantSettings.
2. In the Admin Portal, navigate to Tenant Settings, then locate the section labeled Developer Settings.
   
   • Expand Service principals can use Fabric APIs
   • Enabled = true
   • Apply to = Specific security groups
   • Type the name of the security group you created in the Managed Data Warehouse setup, then select it from the list.
   • Click Apply
     
     
     
     
3. Continue under Developer Settings.
   
   • Expand Service principals can create workspaces, connections, and deployment pipelines
   • Enabled = true
   • Apply to = Specific security groups
   • Type the name of the security group you created in the Managed Data Warehouse setup, then select it from the list.
   • Click Apply
     
     
     
     
4. Next, in the Admin Portal, navigate to Premium Per User, then locate the section labeled Dataset workload settings. Under XLMA Endpoint, select Read Write and click Apply
   
   
   

5. Create a new Workspace (PPU)

1. Click on the Workspaces tile from the left-hand menu and click + New workspace.

2. Name the workspace "ZoneReporting Model" or similar

3. Under the Advanced settings

• Set License mode = Premium per-user
• Semantic model storage format = large semantic model storage format
• Click Apply

6. Set Security group as workspace admin

1. In the new workspace, click Manage access

2. Click + Add people or groups

3. In the search bar type the name of and select the ZoneReporting security group, and under the dropdown menu select Admin, and click Add

7. Link us as your Microsoft Business Partner

1. Link ZoneReporting as a partner by visiting this page:

• • https://portal.azure.com/#blade/Microsoft_Azure_Billing/managementpartnerblade
    
    
• Enter partner ID 5378347
• Click Link a partner ID

Please use the spreadsheet included with your welcome email to share the requested values with your ZoneReporting implementation team. Instructions for secure sharing are included with your welcome email.