Skip to main content
Power BI is Microsoft’s business intelligence service for reports and dashboards. The Power BI connector lets your Lovable app query the semantic models (datasets) behind those reports with DAX (Data Analysis Expressions) and show the results in your app. The connector reuses the measures and dimensions your BI team already maintains, on the models your connection can reach. With Power BI, your app can:
  • Query semantic models with DAX and show the results as tables, charts, and key performance indicators (KPIs)
  • Reuse the measures, dimensions, and relationships your BI team maintains, so the app’s numbers match your reports
  • List the workspaces and semantic models the connection can reach and switch between them at runtime
  • Read a model’s tables, columns, measures, and relationships before writing a query
The connector reads from Power BI only. It does not embed reports or dashboards, push data into Power BI, or refresh semantic models. The connector also queries semantic models that live in a Microsoft Fabric workspace. For lakehouse, warehouse, and SQL database data in Fabric, use the Microsoft Fabric connector.

​
Common use cases and example apps

Use Power BI when your app needs the numbers your reports already show, from the same measures your BI team maintains.

​
How Power BI connections work

The connector calls the Power BI REST API through Lovable’s gateway. Three kinds of requests pass through: listing workspaces, listing semantic models, and running a DAX query against one model with Power BI’s Execute Queries API. The gateway rejects everything else. Before Lovable writes DAX, it reads the model’s tables, columns, measures, and relationships. It queries your governed measures rather than rebuilding them, so a revenue figure in your app is the same measure your report uses. Both ways of connecting use your own Microsoft Entra app registration. With a service principal, Lovable requests a Power BI token with the client credentials you enter, and every query runs as that principal. With a signed-in user, Lovable sends one person to Microsoft to sign in through your app registration and requests the user-delegated permissions Dataset.Read.All and Workspace.Read.All. Every query then runs as that person. If you set a Default semantic model ID in the connection form, Lovable makes it available to linked projects as the default model. It is a default, not a limit: the app can list and switch models at runtime.

​
What this means for data access

The identity that connects decides what everyone on the connection sees. A service principal is one identity for every app user. It cannot query models with row-level security (RLS) roles or models that use single sign-on to their data source, which is the Direct Lake default. A signed-in user queries with that person’s Build permission. Workspace Admin, Member, and Contributor accounts see every row, and row-level security applies to other accounts, such as a Viewer with Build permission. If each user of your app should see only their own rows, use the Power BI app user connector, where each user signs in with their own Microsoft work account. Power BI uses Lovable’s gateway architecture for secure credential handling and automatic token refresh. See Gateway-based connectors for details on authentication and usage limits.
All queries made through this connector run against your own Power BI tenant as the identity you connect with. Power BI capacity, licenses, and billing are handled directly by Microsoft, not by Lovable.

​
How to connect Power BI

Who can create Power BI connections depends on your plan and workspace settings. App + chat connectors are available by default on Free, Pro, and Business plans. On Enterprise plans, they are effectively disabled at first: Who can create connections and clients defaults to No one until an admin changes it in Connectors → Admin settings → App + chat connectors. You can create multiple Power BI connections using different service principals, app registrations, or signing-in accounts, which is useful for separating environments or access levels. When the connection is created, you can link it to the projects where you want to use it. Anyone building in a project can ask Lovable in chat to link their project to it.

​
Prerequisites

Before connecting Power BI, make sure you have:
  • A Power BI workspace that holds the semantic models you want to query, and someone who can manage access to it
  • A Microsoft Entra app registration with a client secret. Both ways of connecting need one. Step 1 in each tab shows how to configure it
  • The Semantic Model Execute Queries REST API tenant setting enabled by a Fabric admin. It can be limited to security groups, so make sure it covers the identity that connects. Step 1 in each tab shows where the setting lives
  • Permission to create connections in your Lovable workspace (see Who can create connections and clients)

​
Choose how to connect

You can connect in two ways, and the choice decides which identity runs every query.
  • Service principal fits shared dashboards and internal tools where everyone should see the same numbers. The connection is not tied to a person, so it keeps working when people leave. Use it with models that have no row-level security roles and no single sign-on to their data source. Import mode models usually qualify. Power BI blocks service principals on both, and Direct Lake models use single sign-on by default.
  • Signed-in user fits models a service principal cannot query, including models with row-level security roles and Direct Lake models. One person signs in through your own app registration, and every query runs with that person’s Build permission. Row-level security filters that person’s results only if the account is not a workspace Admin, Member, or Contributor. The connection depends on that account and its license.
Not sure whether a model has row-level security roles or uses Direct Lake? Ask the model owner before you choose.
Each tab has two parts. Step 1 happens on the Microsoft side, in Microsoft Entra, the Fabric admin portal, and your Power BI workspace, and some items need an admin. Step 2 happens in Lovable. Follow the tab that matches how you want to connect.
Connect with a Microsoft Entra service principal so every query runs as one identity that is not tied to a person. In the connection form, this option is labeled Use your own credentials.PrerequisitesIn addition to the prerequisites above, make sure you have:
  • The Service principals can call Fabric public APIs tenant setting enabled, with the service principal in an allowed security group if the setting is limited to specific groups. Step 1 shows where the setting lives
  • A semantic model without row-level security roles and without single sign-on to its data source. Import mode models usually qualify. Direct Lake models use single sign-on by default and usually fail for a service principal
  • A workspace other than My workspace, because service principals cannot use My workspace
Step 1: Set up Microsoft Entra and Power BIStep 1 creates the service principal and gives it access to your workspace. Your app cannot query a model until the required steps are done.
1

Register an application

If you already have an app registration, reuse it. Otherwise, sign in to the Microsoft Entra admin center, open App registrations, and select New registration. Enter a Name, keep Supported account type at Accounts in this organizational directory only, and select Register.Do not add API permissions. Power BI ignores them for a service principal, and Microsoft recommends leaving them out. See Microsoft’s guide: Create a Microsoft Entra application and service principal.
2

Note the tenant and client IDs

On the app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID. You enter both in Lovable in Step 2.
3

Create a client secret

Go to Certificates & secrets → New client secret, enter a description and an expiry, and select Add. Copy the secret value right away. Microsoft shows it only once.
The client secret functions like a password. Store it securely, and paste it only into the connection form in Lovable. Do not put it in a prompt, a chat message, or your app’s code.
Note the expiry you chose. When the secret expires, the connection stops working until you create a new secret and update the connection in Lovable.
4

Allow service principals to call Fabric public APIs

Ask a Fabric admin to open Admin portal → Tenant settings → Developer settings and enable Service principals can call Fabric public APIs (older name: Allow service principals to use Power BI APIs) for a security group that contains the service principal, or for the whole organization. Microsoft enables this setting by default for new customers, so it may already be on.Do not confuse it with Service principals can create workspaces, connections, and deployment pipelines, which this connector does not need.
5

Enable the Execute Queries API

Ask a Fabric admin to open Admin portal → Tenant settings → Integration settings and confirm that Semantic Model Execute Queries REST API (older name: Dataset Execute Queries REST API) is enabled and covers the service principal. Without it, Power BI rejects every query.
6

Add the service principal to the workspace

In the Power BI service, open the workspace and select More (…) → Workspace access. Under Add admins, members, or contributors, search for the app registration’s display name, select Member, and select Add. The Member role includes the Build permission that queries need, and the Admin role also includes it.
7

Copy the semantic model ID (optional)

Open the model in the Power BI service and copy the ID that follows /datasets/ in the browser address bar. You can enter it in Lovable as the default model.
Step 2: Connect Power BI to LovableOpen the connection form and enter the values from Step 1.
1

Open Power BI in Connectors

Open Connectors and select Power BI. For the other places to open the catalog from, see Where to find connectors.
2

Add a connection

Click Add connection and select App + chat connector.
3

Name the connection

Under Details, Lovable fills in a name for the connection, which you can change (for example, to Power BI Sales). The name is only used inside Lovable to identify the connection.
4

Choose Use your own credentials

Under Configure connection, select Use your own credentials. It is one of two options the form offers, alongside Use your own OAuth app.
5

Enter your credentials

  • Microsoft Entra Tenant ID: the Directory (tenant) ID from Step 1
  • Service Principal Client ID: the Application (client) ID of the app registration
  • Client Secret: the secret value you copied in Step 1
  • Default semantic model ID (optional): the model ID from Step 1. Leave it empty to let the app pick a model at runtime
6

Choose who can use this connection

Under Who can use this connection, decide who in your workspace can use the connection. You start as the only person with access:
  • Only you (default): leave the access list as is; only you can use the connection and its associated data.
  • Invite specific people: add workspace members by email; only you and the people you add can use the connection and its associated data.
  • Invite entire workspace: click Invite entire workspace to make the connection available to everyone in your Lovable workspace.
Everyone with access queries Power BI as the same service principal. See Who can use connections and clients for more information.
7

Connect

Click Connect. Lovable verifies the connection immediately by requesting a token from Microsoft Entra and listing the workspaces the service principal can see. If the test fails, the cause is usually a skipped item in Step 1. See Troubleshooting.
A passing test means Microsoft Entra issued a token and Power BI accepted it. It does not prove a given semantic model can be queried. The test passes even when the service principal is not yet a member of any workspace, and it does not check a model’s row-level security or single sign-on settings. Confirm the connection with a real query after you link it to a project.
When connected, anyone building in a project can ask Lovable in chat to link their project to Power BI (based on configured connection-level access). Your Lovable apps can then query your semantic models with DAX while you build and after you publish.

​
Limitations

The Power BI app + chat connector documented on this page has these limits.
  • Read-only. The connector reads from Power BI only. It does not embed reports or dashboards, push data into Power BI, refresh semantic models, or export reports. To show a report’s numbers in your app, rebuild the visuals on the same measures the report uses.
  • One DAX query and one result table per request. Power BI’s Execute Queries API runs one query per call and returns one table per query. Results are capped at 100,000 rows or 1,000,000 values, whichever comes first, and at 15 MB. When a query hits a cap, Power BI still reports success and returns the rows that fit, with the error inside the response. A truncated result can look complete, so your app must check for that error.
  • Rate limits. Lovable’s gateway allows 100 requests per minute per connection, and Power BI allows 120 query requests per minute per user. An app + chat connection counts as one user, so every user of your app shares that budget.
  • Service principals cannot query every model. Power BI refuses service principal queries on models with row-level security roles and on models that use single sign-on to their data source, which is the Direct Lake default. Use an Import mode model without RLS roles, or connect as a signed-in user instead.
  • Row-level security follows the connected identity, not your app’s users. Everything built on a connection queries Power BI as the one identity that connected. For a signed-in user, workspace Admin, Member, and Contributor accounts see every row, and row-level security applies to other accounts, such as a Viewer. To give each end user their own rows, use the Power BI app user connector so each user signs in with their own Microsoft work account.
  • Sign-in is limited to the tenant that owns the app registration. Both the signed-in user option and the app user connector send people to that Microsoft Entra tenant’s sign-in, so only accounts in that tenant, and its guests, can sign in.

​
Troubleshooting

Lovable verifies a service principal connection the moment you click Connect, and saves a signed-in user connection as soon as Microsoft issues tokens. Most problems trace back to a step in Microsoft Entra or the Fabric admin portal. These are the most common:
Lovable could not get a token for the service principal. The tenant ID, client ID, or client secret is wrong, or the secret has expired. Compare the values with the app’s Overview page in the Microsoft Entra admin center, and check the expiry under Certificates & secrets. If the secret has expired, create a new one, then open the connection in Lovable and click Update to enter it.
For a service principal, a Fabric admin must enable Service principals can call Fabric public APIs under Admin portal → Tenant settings → Developer settings and include the principal, or a security group that contains it. Then click Connect again, or Update on an existing connection. For a signed-in user, the token is missing the Workspace.Read.All permission. Click Reconnect and accept the consent prompt. If the tenant blocks user consent, have a Microsoft Entra admin grant the delegated Dataset.Read.All and Workspace.Read.All permissions on the app registration first.
This is a token problem, not a permission problem. For a signed-in user, click Reconnect to sign in again. If reconnecting fails, the Microsoft Entra error names the cause, usually an expired client secret. For a service principal, test the connection again.When the client secret has expired, create a new one under Certificates & secrets → New client secret. Then open a service principal connection and click Update to enter it, or open a signed-in user connection, enter it, and click Reconnect to sign in again. If a service principal connection keeps failing with a valid secret, contact Lovable support and include the request ID if the error message shows one.
For a service principal, the connection test only checks that it can list workspaces, and an empty list passes. Add the principal to the workspace under Workspace access with the Member role, and use a workspace other than My workspace, which service principals cannot use. For a signed-in user, give the account access to the workspace.

​
Manage your connection

Connections are managed from Connectors: select , then open the connection.
  • Unlink projects to remove access from specific projects while keeping the connection available for others. See Unlink projects from a connection for the steps.
  • Delete the connection to remove it from the workspace entirely. Deleting is permanent. It removes the credentials from all linked projects, and app features that use stop working until a new connection is added. See Delete a connection for the steps and who can delete.