Guides

Power BI Tenant Inventory & Audit: A Practical Guide

2026-07-24 · 7 min read

Sooner or later every BI team gets the question — from an auditor, a security review, or a new CIO: "What exactly do we have in Power BI?" How many workspaces, which reports, whose semantic models, connected to which data sources, shared with whom. Most tenants cannot answer it, because Power BI itself never shows you the whole estate in one place.

What a real inventory must cover

  • Workspaces — including admin-only ones you are not a member of, and the (usually enormous) pile of personal "My Workspaces".
  • Reports — standard and paginated, with the workspace and app they are published through.
  • Semantic models — owner, refresh schedule, refreshability.
  • Apps and their audiences — who content is actually shared with.
  • Capacities — which workspaces run on which SKU.
  • Data sources — what each model actually connects to (the lineage layer).

Method 1 — The admin portal

The Fabric admin portal lists workspaces tenant-wide and exports them to CSV. It is the fastest first look, but it stops at the workspace level: no report list, no model detail, no data sources, no usage. Treat it as a headcount, not an inventory.

Method 2 — PowerShell and the admin REST APIs

The admin cmdlets and REST endpoints go much deeper — every workspace with its contents, tenant-wide report and app catalogs:

Login-PowerBI  # admin account or service principal

# Every workspace in the tenant, including ones you are not in
Get-PowerBIWorkspace -Scope Organization -All

# Tenant-wide report catalog (REST, paged with $top)
Invoke-PowerBIRestMethod -Method Get -Url "admin/reports?`$top=5000"
Mind the limits: results are paged (large tenants need multiple calls per entity type), admin APIs have hourly rate limits, and each run is still a snapshot — the moment the script finishes, the output starts going stale. You also own scheduling, storage and auth for the script itself.

Method 3 — The scanner (metadata) API

For deep metadata at scale Microsoft provides the scanner API: you submit batches of up to 100 workspaces, poll for the scan to finish, and receive detailed metadata — including model tables and data sources — with an incremental "modified since" mode for follow-up scans. It is the most complete DIY foundation, and also the most work: a stateful pipeline with batching, polling, incremental bookkeeping and schema drift, all maintained by you.

The audit angle: inventory needs history

An auditor rarely asks "what exists today?" alone. The follow-ups are "when did this appear?", "who could see it in March?", "why did this workspace disappear?". Point-in-time exports cannot answer those — you need a catalog that records changes over time and marks deletions instead of erasing them.

What a continuous catalog adds

PGR Sonar syncs the whole estate on schedule: workspaces (member and admin-level, personal ones flagged as such), reports, semantic models with refresh schedules, apps with their access lists, capacities and data-source lineage. Deleted items are soft-marked rather than dropped, so the catalog keeps answering "what changed since the last audit" — and because usage and refresh history live in the same store, the inventory is joined to how content actually behaves, not just that it exists.

Frequently asked questions

Can I inventory workspaces I am not a member of?

Yes — that is exactly what the admin APIs are for. With a Fabric administrator role (or a service principal authorized for read-only admin APIs), calls like Get-PowerBIWorkspace -Scope Organization return every workspace in the tenant, including ones you have never been added to. Member-level APIs only ever show your own workspaces, which is why inventories built without admin scope are silently incomplete.

How often should a tenant inventory be refreshed?

Daily, if you want it to stay trustworthy. Content in a healthy tenant changes every day — new reports, deleted workspaces, republished apps — and a spreadsheet export starts drifting from reality the moment it is saved. Governance decisions (cleanup, access reviews, audits) need a catalog that is at most a day old.

Should personal "My Workspace" content be part of the inventory?

It should be visible but treated separately. Admin APIs do return personal workspaces — often thousands of them in a mature tenant — and they matter for security review, but they are personal drafts, not published estate. A good inventory lists them, labels them as personal, and keeps them out of governance metrics like unused-content counts.

Do this continuously, without the scripts

PGR Sonar inventories your whole Power BI / Fabric tenant, keeps usage, capacity and refresh history long-term, and flags what needs attention — read-only, metadata only, running on autopilot.

Start free 14-day trial

No credit card required.