Governance, FinOps and observability for Power BI and Fabric
PGR Sonar is a multi-tenant SaaS platform that gives you a clear, read-only view of your Microsoft Power BI and Microsoft Fabric estate. It catalogs your assets, maps their lineage, surfaces unused reports, and monitors Fabric capacity health so you can govern, optimize and control the cost of your analytics platform.
What PGR Sonar is
Sonar connects to your organization's Power BI and Fabric tenant through Microsoft Entra ID (Azure AD) and reads tenant metadata such as workspaces, apps, reports, semantic models, capacities, and activity and usage logs. That metadata is synced into an encrypted PostgreSQL database, where Sonar turns it into unified catalogs, data lineage, unused ("zombie") asset detection, and Fabric capacity health monitoring.
Who it is for
Sonar is built for the teams responsible for a Power BI or Fabric platform: Center of Excellence and BI platform owners who need a single source of truth for governance; FinOps and finance teams who need to understand and optimize capacity spend; and administrators who need visibility into permissions, usage and lineage across many workspaces.
The read-only security model
Sonar is strictly read-only. It authenticates with Microsoft Entra ID OAuth2 and Azure service principals, and it only ever reads from your tenant. It never creates, modifies or deletes anything in your Power BI or Fabric environment, and it never reads the contents of your reports or the business data inside your datasets. Only metadata is collected, and each customer's data is isolated per account.
Read-only by design. PGR Sonar cannot change your tenant. Every permission it requests is a read scope, so onboarding carries no risk to your production Power BI and Fabric environment.
Getting started
You can be up and running in a few minutes. Create an account, grant read-only consent to your Microsoft tenant, choose which workspaces to sync, and let the first background sync populate your catalog.
Create an account and start your free trial
Register at app.sonar.pgrdata.com/register. The 14-day free trial covers up to 10 combined Reports and Semantic Models and requires no credit card.
Connect your Microsoft tenant
Connect Power BI and Fabric through Microsoft Entra ID OAuth using read-only consent. You provide your tenant's Entra application (client) ID, tenant ID and a client secret, which Sonar stores encrypted at rest. See Connecting Power BI & Fabric for the full setup.
Configure which workspaces to sync
Choose the workspaces you want Sonar to catalog. You stay in control of the scope, so you can start with a few workspaces and expand over time.
Let the first sync complete
A background sync runs automatically and typically completes within minutes. When it finishes, your catalogs, lineage and capacity views are populated and ready to explore.
Trial limits. The free trial is capped at 10 combined Reports and Semantic Models. To sync a larger estate, move to the Core plan. See the FAQ for the differences between the trial and paid plans.
Core concepts
A small set of concepts describes how Sonar organizes your data and keeps every customer isolated.
Organization
The top-level tenant in Sonar. It groups your accounts and the users who administer them.
Account
The unit of isolation within an organization. Each account holds one Power BI / Fabric connection and its synced assets.
Configuration
Your Power BI connection details for an account: the Entra application, tenant ID and encrypted client secret used to read your tenant.
Synced assets
The Power BI and Fabric objects Sonar reads: workspaces, apps, reports, semantic models and capacities.
How the pieces fit together
The hierarchy is straightforward: an Organization contains one or more Accounts. Each account has a Configuration that describes how Sonar connects to your Power BI and Fabric tenant. Once connected, Sonar reads your Power BI assets into that account: Workspaces, Apps, Reports, Semantic Models and Capacities.
Multi-tenancy and data isolation
Sonar is multi-tenant, and isolation happens at the account level. The assets, metadata and job history synced for one account are kept separate from every other account and organization. Your data is only ever visible to the users you grant access to.
Connecting Power BI & Fabric
A three-step guided setup connects Sonar to your tenant through a service principal: connect, verify, choose what to monitor. The connection is read-only, and Sonar checks its own permissions live — anything missing is named precisely, with the exact setting or consent link that fixes it.
Two ways to connect
- The ready-made PGR Sonar connector (recommended) — you enter only your Microsoft Entra tenant ID and grant admin consent from the wizard. There is no secret to create or rotate, and Sonar verifies the consent when Microsoft redirects you back — it is never assumed.
- Your own app registration — you supply the tenant ID, application (client) ID and a client secret. The secret is encrypted at rest with Fernet symmetric encryption and is never stored or shown in plain text.
How access is granted
Sonar reads tenant-wide metadata through Microsoft's read-only admin and metadata-scanning APIs. For a service principal, access to those APIs is not an app permission — it is granted by a Fabric administrator through two tenant settings in the Microsoft Fabric admin portal → Tenant settings, scoped to a security group that contains Sonar's service principal:
Service principals can use Fabric APIs(Developer settings)Service principals can access read-only admin APIs(Admin API settings)
That is the whole baseline — no workspace-by-workspace access work is needed for the catalog. Optional features use their own, separately named grants: License Inventory needs User.Read.All (application) admin consent on the connected app for Microsoft Graph; Capacity metrics needs the Microsoft Fabric Capacity Metrics app installed and the service principal given access to its workspace; and adding the service principal as a Viewer on selected workspaces unlocks deeper per-dataset refresh history for them.
Sonar verifies its own setup
During setup — and any time later from the Connection health panel — Sonar probes every permission it uses live against your tenant: app sign-in, the read-only admin APIs, audit-log access, Graph consent, Capacity Metrics access and more. Each check shows Ready or exactly what is missing, with the tenant setting or consent link to fix it. Optional features simply wait and switch on automatically once their permission is granted; only app sign-in and the read-only admin APIs are required to finish setup.
Strictly read-only. None of the access Sonar uses can write to your tenant. Sonar reads metadata and usage signals only; it never modifies Power BI or Fabric objects and never accesses report contents or the business data inside your datasets.
How the secret is protected
The client secret is encrypted with Fernet before it is written to the database, and it is decrypted only in memory when Sonar authenticates to your tenant to run a sync. Customers who require additional isolation can request a private, dedicated Azure deployment — see the FAQ.
Features
Sonar turns the metadata it syncs into practical tools for governance, security, cost control and reliability.
Unified asset catalogs
Browse every workspace, app, report, semantic model and capacity across your tenant in one place. The catalog gives platform owners a single source of truth for what exists, where it lives and how it is related.
App permissions & security auditing
Review who has access to Power BI apps and their content so you can audit permissions, spot over-sharing and keep access aligned with your governance policy.
Data lineage & activity logs
See how reports and semantic models depend on one another, and combine that lineage with synced activity and usage logs to understand how assets are actually being used across the tenant.
Unused (zombie) asset hunter
Sonar uses usage-based detection to flag reports and other assets that are no longer being used — "zombie" assets. Identifying them helps you retire clutter, reduce risk and reclaim capacity.
Fabric capacity health & metrics monitoring
Monitor the health of your Fabric capacities using synced capacity metrics, so you can keep an eye on utilization and spot pressure before it affects your users.
Capacity optimization suggestions
Building on capacity metrics and usage signals, Sonar surfaces suggestions to help you optimize how your Fabric capacity is used and keep spend under control.
Sync & scheduling
Background workers keep your catalog current by reading fresh metadata from your tenant on a schedule you control. The engine reads through Microsoft's bulk metadata-scanning APIs — a fraction of the API calls of item-by-item crawling — and detects real deletions, so removed reports and models are marked instead of lingering.
Sync stages
A sync runs as an ordered pipeline of six stages. The first two form the always-on estate catalog; the rest are features you can toggle on the Tenant Connection page:
| Stage | What it reads |
|---|---|
| Tenant inventory | Workspaces with their access rosters, capacities, and the published-app catalog with app permissions. |
| Estate scan | Reports, semantic models, Fabric items (Lakehouses, Warehouses, notebooks and more), folder locations, endorsements, sensitivity labels and data lineage — via Microsoft's metadata-scanning APIs, incrementally after the first run. |
| Refresh monitoring | Refresh schedules, history and failures for semantic models. |
| Usage & audit | Report views, exports and shares from the tenant activity log. |
| License inventory | Microsoft license assignments per user, from Microsoft Graph. |
| Capacity metrics | CU consumption per item from the Microsoft Fabric Capacity Metrics app. |
A stage that is waiting on a Microsoft permission does not fail the sync — it is reported as blocked with the exact fix, and it resumes automatically once the permission is granted.
Scheduling and manual runs
One schedule covers everything you monitor. On fast cadences the usage and capacity telemetry refresh on every run while the full catalog refreshes on the first run of the day — fresh data without tripping Microsoft's API limits. You can also trigger a sync manually at any time; plan limits are shown right on the Sync page.
Job history and monitoring
Every sync run is recorded in a Job History you can monitor. You can see the status of each run and cancel a run that is in progress, giving you full visibility and control over the work Sonar performs against your tenant.
Roles & permissions
Sonar uses role-based access control (RBAC) so you can grant people exactly the access they need, at the level they need it.
| Role | Scope | What it can do |
|---|---|---|
ORG_ADMIN | Organization | Manage the organization and the accounts within it. |
ACCOUNT_ADMIN | Account | Full management of a specific account. |
ACCOUNT_READER | Account | Read-only access to a specific account. |
Inviting users
Users can be invited into an organization or into specific accounts, and their role determines whether they can administer or only read what they have been granted. This makes it easy to give a FinOps analyst read access to a single account while keeping platform administration in the hands of your admins.
Frequently asked questions
How does Sonar authenticate to my tenant?
Sonar authenticates with Microsoft Entra ID OAuth2 and Azure service principals. The connection is strictly read-only, so Sonar can read metadata from your tenant but can never modify it.
What data does Sonar store?
Sonar stores only metadata — workspaces, apps, reports, semantic models, capacities, and activity and usage signals. It never stores the contents of your reports or the business data inside your datasets. Metadata is held in an encrypted PostgreSQL database hosted in Azure.
Can Sonar change anything in Power BI or Fabric?
No. Every permission Sonar uses is a read scope. It cannot create, update or delete workspaces, reports, datasets, capacities or any other object in your tenant.
What is the difference between the free trial and the Core plan?
The free trial runs for 14 days, requires no credit card, and covers up to 10 combined Reports and Semantic Models so you can evaluate Sonar on a slice of your estate. The Core plan lifts those limits so you can catalog and monitor your full Power BI and Fabric environment. See the pricing page for current details.
Can Sonar run in a private or dedicated environment?
Yes. A private, dedicated Azure deployment within its own virtual network (VNet) is available for organizations that require it. Contact sales@pgrdata.com to discuss a dedicated deployment.
Support
We are here to help you get the most out of PGR Sonar.
Product support
Questions about using Sonar or troubleshooting a sync? Email sonar@pgrdata.com.
Sales & plans
Plans, pricing or a dedicated deployment? Email sales@pgrdata.com.
Product site
Learn more at sonar.pgrdata.com.
Pricing
Compare plans at sonar.pgrdata.com/pricing.