Power BI MCP connector

Query your published Power BI semantic models from any MCP client

NL → DAX semantic layer

built specifically for you

What I build

input: DAX · free download

This tool

MCP client

Claude Desktop, Cursor, etc.

Your Power BI models

your data, your rules

You have this

What you get

Persistent authentication
RLS enforced
No Fabric, no GitHub Copilot needed
Runs locally, your data stays between you and your LLM

Prerequisites

Windows
Power BI Pro license

Free & open source · View on GitHub

See it in action

One connector. Two users. Same DAX. Two answers.

Power BI Dana · Sales Director RLS · All regions

$4.28M Revenue

1,284 Orders

Revenue by region

North $1.12M

South $940K

West $861K

East $772K

Central $587K

Power BI Sam · Account Manager, West RLS · West only

$861K Revenue

263 Orders

Revenue by region

West $861K

Same question. Different answers. That's RLS.

// Sign in once. Tokens cached and encrypted locally.
// Plain English in. Real DAX out.
// Same model. Different user.
// Same question. RLS enforced by Power BI itself.
// What you get.
// Free. A Pro license is enough.

Setup instructions

Your IT admin completes these steps once per organization. After this, they hand users the PBIConnector.exe, a Client ID, and a Tenant ID.

Step 1

Register an Entra ID app

Global Admin

Go to Azure Portal > App registrations > New registration.
Name it PBI Connector, set to Single tenant only, leave redirect URI blank.
Copy the Application (client) ID and Directory (tenant) ID from the overview page.
Under Authentication, add redirect URI: select Mobile and desktop applications, add http://localhost.
On the same page, set Allow public client flows to Yes.
Under API permissions, add Power BI Service (delegated): Dataset.ReadWrite.All and Workspace.Read.All.
Click Grant admin consent. Both must show green "Granted" status. Consent can take up to 15 minutes to take effect.

No client secret needed. The connector uses a public client OAuth flow. Dataset.ReadWrite.All is required for XMLA connectivity even though the connector never writes; without it, queries fail with "workspace not found" for users who are not workspace members.

Step 2

Enable XMLA endpoints

Power BI Admin

Go to Power BI Admin Portal > Tenant settings.
Find XMLA endpoints (under Integration settings).
Set to Enabled (or enable for specific security groups).

Takes up to 15 minutes to propagate. XMLA ensures RLS is enforced server-side.

Step 3

Assign user permissions

M365 / Workspace Admin

Each user needs:

Power BI Pro license (or higher), assigned in M365 admin center.
Read permission on the semantic model, or a workspace role (Viewer or higher).

Done? Distribute to each user:

1. The PBIConnector.exe file
2. The Client ID
3. The Tenant ID

Unblock the zip first: before extracting, right-click the downloaded zip > Properties > check Unblock > OK (or run Unblock-File in PowerShell). This removes the download flag so users don't see the Windows SmartScreen warning ("Windows protected your PC") when running the exe. If it appears anyway, it's safe to click More info > Run anyway.