Case study · Business Intelligence

An AI with governed access to Power BI. Read-only, by design.

LiveRead-onlyA masked CRM datasetSet up on 17 October 2026

1 day

From a new Microsoft tenant to the first query answered.

0 secrets

The app has no client secret. Claude signs in as me, with read scopes only.

98 measures

Each one run once through the connection: 91 answer and 7 fail.

2 root causes

Behind the 7 failures, found by queries before any report was opened.

3 tools

Execute a query, read the schema, read a report's metadata. A fourth stays off.

The AI never touches the data. It asks the model, which answers under my permissions.

The question

Everyone wants an AI "on top of" their reports. The hard part is not the AI; it is giving it access that a regulated company could sign off: read-only, scoped, under a named user, with nothing stored in between.

So I built that access from scratch, on this domain, and let Claude use it. The model is a CRM report of mine, with the numbers masked.

How it works

Four pieces, and none of them is custom code.

A tenant of my own.A Power BI account on this domain, with the tenant setting "Power BI Model Context Protocol server endpoints" switched on.
An app registered in Entra.Single tenant, a public client with no secret, delegated read permissions on datasets and workspaces, and admin consent.
A connector in Claude.Pointed at Microsoft's endpoint, api.fabric.microsoft.com/v1/mcp/powerbi, with that app's client ID. Sign-in is single sign-on; no password is typed anywhere.
A model in a shared workspace.The report, published to a workspace of the Pro type. Claude writes the DAX and runs it; the model answers with my permissions, so row-level security would apply.

Who did what

What I decided and did

Chose to go straight to a live connection, not screenshots: it is the version an interviewer can watch.
Created the Power BI account, started the trial, created the workspace and published the model.
Added the connector in Claude and authorised every tenant change before it was made.
Decided what the data would be: my own CRM report, masked.

What the AI did Claude

Read Microsoft's documentation and planned the four pieces.
Registered the Entra app and set the tenant setting, each step with my permission.
Diagnosed the failure below and proposed the fix that worked.
Ran the first queries and checked them against the report.

What broke

The schema came through. Every query failed.

From my personal workspace, reading the model's structure worked at once. But every query, even EVALUATE ROW("Test", 1), came back with "Couldn't reach Power BI". Starting the Premium per-user trial changed nothing.

What fixed it: publishing the same report to a shared workspace of the Pro type. There, the first query answered immediately, and the old model kept failing. Microsoft's documentation does not explain why. The observation is recorded as it is.

First results

A consistency checkRevenue by product, summed, equals the model's own [Overall Revenue] measure to the cent.
Seven broken measuresOf 98, each run once with no filters. Two are the cause, and five more fail because they depend on them: columns that load as text are compared with numbers.
A number still to reconcile[Active Players] returns 597 with no filters, while the report page shows 1,645. The page's filters are the likely cause. Not settled yet.

Limitations

Not publicA visitor cannot open it: the connection needs their own Claude and their own Microsoft access. It is shown live in conversations, and as a recording here, later.
A trialThe licence that makes it work ends on 16 December 2026. After that it needs a paid licence, or the live demo stops.
One tool offMicrosoft's "generate query" tool needs Copilot, so it stays disabled. Claude writes the DAX itself.
Masked dataThe numbers are not business figures. The structure, the measures and the faults are real.
PreviewThe endpoint is in preview and may change.

The same model, three ways: the original report, my repaired version, and a dashboard Claude builds through this connection. Recorded, so the comparison can be watched.