skills.rest
data-goblin
data-goblinCOMMUNITY
Explore all skills by this author →
Website𝕏@kurtbuhlerGitHub

audit-tenant-settings

Audit Fabric and Power BI tenant settings against a curated baseline and report drift.

887|131|Updated Jan 15, 2026
Search Tags:#drift detection#audit#Power BI#Fabric#security groups#Governance#tenant settings
One-click install
npx skills add https://github.com/data-goblin/power-bi-agentic-development --skill audit-tenant-settings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-tenant-settings
Source: https://github.com/data-goblin/power-bi-agentic-development/tree/main/plugins/fabric-admin/skills/audit-tenant-settings
Command: npx skills add https://github.com/data-goblin/power-bi-agentic-development --skill audit-tenant-settings

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, reportlab, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Fabric and Power BI tenant administrators struggle to know whether their tenant settings match a sensible governance baseline, what changed since the last review, and which delegated overrides or security groups silently weaken their posture. This Skill automates that audit end to end.

Core Features & Use Cases

  • Baseline drift audit: Fetches live tenant settings via the fab CLI, merges them with a curated metadata baseline of 159 settings, and renders a markdown report with compliance status, risk levels, and recommendations.
  • Change detection and PDF briefing: Snapshots each run and diffs against the previous one (added, removed, toggled, SG-scope, and property changes), plus a one-to-two-page PDF briefing for stakeholders.
  • Delegated overrides and security group review: Enumerates capacity, domain, and workspace overrides and investigates the Entra security groups behind SG-scoped settings for red flags like empty groups, guests, or stale owners.
  • Use Case: Ask for a tenant governance audit before a quarterly security review; the Skill produces a drift report, flags high-risk settings like publish-to-web, and opens a grounded discussion about which changes to pilot.

Quick Start

Ask the agent to run a Fabric tenant settings governance audit and summarize any drift, high-risk settings, and security group concerns.

Frequently Asked Questions about audit-tenant-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Fabric tenant settings for configuration drift?▼

Run the bundled audit script with uv run scripts/audit-tenant-settings.py after authenticating the fab CLI with a Fabric admin account. It fetches live settings via the admin API, compares them against a curated baseline of 159 settings, and renders a markdown report with drift, risk levels, and recommendations.

How to detect changes in Power BI tenant settings over time?▼

The audit script saves a snapshot JSON after each run and diffs the next run against it, reporting added, removed, toggled, security-group, and property changes. Use --snapshot to keep per-tenant snapshots isolated or --no-snapshot to skip change detection.

What permissions are needed to audit Fabric tenant settings?▼

You need a Fabric or Power BI admin account authenticated in the fab CLI for the admin tenant settings APIs. For security group investigation, the az CLI needs Group.Read.All, User.Read.All, Directory.Read.All, and RoleManagement.Read.Directory Graph permissions.

Can I generate a PDF report of a Fabric tenant audit?▼

Yes, run scripts/generate_audit_pdf.py with uv to produce a one-to-two-page A4 PDF briefing with headline counts, changes since the last snapshot, a drift table, and a delegated-overrides summary. It reuses the same audit logic and snapshot path as the markdown report.

Does the audit cover capacity and workspace setting overrides?▼

Yes, the workflow enumerates delegated tenant setting overrides at capacity, domain, and workspace scopes via the Fabric admin API. Each override is classified as drift-vs-tenant, drift-vs-recommended, high-risk, or orphan before reporting.

Why does the tenant settings audit fail with a 401 or 403 error?▼

A 401 or 403 from the admin API means the authenticated account is not a Fabric or Power BI admin, or the fab CLI session has expired. Run fab auth login with an admin account and verify access with fab api admin/capacities before rerunning the audit.

Related Skills

Explore More Data & Analytics Skills→
selrai-companyselrai-company

outlook-connector

Install and operate a Microsoft Outlook and Microsoft 365 connector for email, calendar, files, and Teams.

Official
Advanced
ArtisanClarinetsArtisanClarinets

security-best-practices

Enforce RBAC, CSRF, CSP, audit logging, and tenant isolation in Next.js admin portals.

Community
Advanced
rbutinarrbutinar

fabric-items-list

Lists inventory items in a Fabric Workspace filtered by type.

Community
Intermediate
yunmoxingheyunmoxinghe
2

microsoft-docs

Search and retrieve official Microsoft documentation via the Microsoft Learn MCP Server.

Community
Intermediate