Grant admin consent (AD grants)

This is the single most important step for a popup-free experience.

Icon Map signs in each user with their Microsoft Entra (Azure AD) identity and, on their behalf, reads their Fabric and OneLake data. To do that it requests a set of delegated permissions. If those permissions haven't been consented to at the tenant level, each user is prompted to consent the first time a feature needs them - the "Permissions requested" popup. Granting tenant-wide admin consent once removes those prompts for everyone.

The workload is registered as two Entra applications, a frontend and a backend, and both need consent. This page covers both.

The short version

If the person adding the workload is an Entra administrator, the whole thing is three prompts inside Fabric: one when the workload is added (the backend application), one when the first map is opened (the frontend application), and one the first time a Lakehouse or Eventhouse is connected (the on-demand OneLake or Eventhouse permission). Tick Consent on behalf of your organization on each and nobody else in the tenant is ever asked. Administrators who would rather not open the product can do all of it, including preparing the tenant and pre-approving the on-demand permissions, with one script: Onboard-IconMapTenant.ps1 (Option C). Everything below explains what those prompts contain and the alternatives.

Who does this

A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator in Microsoft Entra.

The applications

The frontend is the application your users sign in to. The backend is the application Fabric itself calls for every item create, save and delete, and the one that runs Tileset Builder jobs and serves the Power BI visuals. Consenting only the frontend leaves the tenant half set up.

What you're consenting to

Tekantis.IconMap (frontend)

The frontend requests these delegated permissions. They map directly to the product features that read your data:

Two permissions are deliberately not in this list and are requested on demand instead, the first time a feature needs them - see Permissions requested on demand:

Note what else is not in the list. Icon Map holds no Lakehouse.* or Eventhouse.* Fabric permission: Lakehouse tables and files are read straight from OneLake, and Eventhouse is queried against the Kusto cluster. It also holds no Tenant.Read.All or Tenant.ReadWrite.All, the Fabric admin-API permissions, so it cannot see anything tenant-wide.

Every one of these is delegated (acts as the user) - there is no app-only data access in the authoring experience.

openid, profile and offline_access on Microsoft Graph are consented alongside them - these are the sign-in basics and carry no data access. offline_access is what the consent dialog describes as "Maintain access to data you have given it access to": it lets Icon Map refresh your token silently instead of re-prompting.

Tekantis.IconMap-Backend

The backend never holds a session of its own. When Fabric calls it, or when a Power BI visual signs in to it, it exchanges the caller's token on behalf of that user (OAuth 2.0 On-Behalf-Of) for short-lived Fabric and OneLake tokens, so it reaches only what the user already can. Its delegated permissions are a subset of the frontend's:

It also holds the one application (app-only) permission in the whole Icon Map estate: Microsoft Graph CrossTenantInformation.ReadBasic.All, used to resolve your tenant's display name and domain. That is directory metadata and grants no access to your data, but it appears on the consent screen under Application permissions, and only an administrator can grant it. That is one reason the backend needs admin consent rather than user consent.

The backend also reads and writes OneLake on the user's behalf - Tileset Builder output, and organizational-catalog manifests and Lakehouse images for the Power BI visuals - with Azure Storage user_impersonation. Like the frontend's, that permission is requested on demand: Icon Map asks for it the first time someone starts a Tileset Builder job, and an administrator can pre-approve it for everyone (see Permissions requested on demand).

Unlike the frontend, the backend requests its whole permission set at once (/.default). A permission missing from the tenant-wide grant does not prompt anyone; the call simply fails. If Tileset Builder jobs or Organizational Catalog browsing from Power BI stop working after consent was changed, re-run the backend's admin-consent URL below, then re-grant the on-demand Azure Storage permission for the backend.

About the "All" in these names

Item.Read.All, Dataset.Read.All and the rest read as though Icon Map can see everything in your tenant. It cannot. These are delegated permissions: the token carries the signed-in user's identity, and Fabric evaluates that user's own item permissions on every call. Item.Read.All means "read the items this user is already allowed to read". The suffix is Microsoft's naming convention for the whole Fabric API surface, not a statement of reach - there is no narrower Item.Read variant to request instead. The permissions that genuinely span a tenant are Tenant.Read.All and Tenant.ReadWrite.All, and Icon Map requests neither.

If you want to narrow reach further, do it by controlling who can use the app rather than by scope: see Restricting who can use Icon Map below.

Restricting who can use Icon Map

Admin consent is tenant-wide, but use of the application does not have to be. Two controls, both entirely in your hands and neither requiring anything from Tekantis:

• Require assignment. In Entra ID, Enterprise applications, Tekantis.IconMap, Properties, set Assignment required to Yes, then add only the users or groups who should have Icon Map under Users and groups. Anyone outside that set is refused a token, whatever the consented permissions say. This pairs well with scoping the Fabric tenant settings to the same security group.
• Conditional Access. Target the application with a Conditional Access policy for MFA, compliant or hybrid-joined devices, named locations, or sign-in frequency, the same as any other enterprise application.

For most organisations this is a more meaningful control than the permission list, because it bounds who can act at all rather than what a permitted user could already do for themselves.

Before you consent: prepare your tenant

Microsoft Entra will only let an application be consented for a Microsoft service once that service has an entry - a service principal - in your tenant. Entra creates that entry the first time any third-party application is consented for the service, but it cannot create it as part of that same consent. Fabric does not create it either. So in a tenant that has never used a service through a third-party app, the first consent for it fails with:

AADSTS650052: The app is trying to access a service '<id>'(Azure Storage) that your
organization '<tenant>' lacks a service principal for.

Icon Map's own consent no longer depends on such services (only Microsoft Graph and Power BI, which every Fabric tenant has), so the two admin-consent URLs below work in any tenant. But the first time someone connects a Lakehouse (Azure Storage) or an Eventhouse (Azure Data Explorer), Entra needs the entry to exist. Create it once, in Azure Cloud Shell or any az session signed in to your tenant as a Cloud Application Administrator, Application Administrator or Global Administrator:

az ad sp create --id e406a681-f3d4-42a8-90b6-c2b029497af1

and, only if you will connect Eventhouse / KQL sources:

az ad sp create --id 2746ea77-4702-4b45-80ca-3c97e680e8b7

Both are idempotent - "Another object with the same value for property appId already exists" means it was already there. The Graph PowerShell equivalent is New-MgServicePrincipal -AppId <id>. These entries carry no credentials and grant no access; they are the same objects Entra would create silently the first time another application used those services. To check whether your tenant already has them, look for Azure Storage and Azure Data Explorer under Enterprise applications with the Application type filter set to All applications.

In the Azure portal instead. There is no page in the Microsoft Entra admin center that creates the entry for a Microsoft service (Enterprise applications, New application only offers the gallery and your own registrations), but you can run the command without installing anything by using the portal's built-in shell:

1. Sign in to portal.azure.com as an administrator of the tenant.
2. Select the Cloud Shell icon in the top bar (the >_ symbol) and choose PowerShell. The first time, accept the storage prompt or choose No storage account required.
3. Check the shell is in the right tenant: az account show --query tenantId -o tsv. If it is not, run az login --tenant <your-tenant-id> --allow-no-subscriptions.
4. Paste the az ad sp create line above and press Enter.
5. Confirm under Microsoft Entra ID, Enterprise applications with the Application type filter set to All applications: Azure Storage now appears.

Or download the script: Prepare-IconMapTenant.ps1 does the check and the creation in one go (-TenantId <guid>, add -IncludeEventhouse for the second entry, -WhatIf to preview) and needs only the Azure CLI, so it also runs in Cloud Shell.

How to grant consent

Consent both applications. Every method below consents an application's whole permission set in one action - there is no need to consent feature by feature.

Option A - accept the prompts inside Fabric (recommended)

When an administrator adds the workload and opens the first map, Fabric shows the consent prompts itself, and an administrator's prompt carries a Consent on behalf of your organization checkbox. Ticking it records the same tenant-wide grant as the URLs below.

1. Sign in to Fabric as a user who is both a Fabric administrator (or capacity administrator) and an Entra Global, Cloud Application or Application Administrator.
2. Add the workload from the Workload hub. A prompt for Tekantis.IconMap-Backend appears - the application Fabric calls for every item operation. Tick Consent on behalf of your organization and choose Accept.
3. Create or open an Icon Map item. A prompt for Tekantis.IconMap appears the first time the editor asks Fabric for a token. Tick the box again and choose Accept.
4. Connect a Lakehouse (and, if you use them, an Eventhouse). The on-demand permission prompts once; tick the box a third time. In a tenant that has never used Azure Storage, this is the step that shows the prepare your tenant page instead - run the one command and try again.

That is the complete onboarding for most organizations. If the checkbox is missing, your account lacks an administrator role or your tenant's consent policy has disabled it; use Option B.

Option B - admin-consent URLs

For administrators who prefer to consent before the workload is rolled out to anyone, or without opening the product. Open each of the following URLs in turn, signed in as an administrator, replacing {your-tenant-id} with your Entra tenant ID (a GUID). Review the permissions and choose Accept each time to consent for your whole organization.

Frontend, Tekantis.IconMap:

https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=8ac140d7-88a0-4857-84b4-73c708afd645

Backend, Tekantis.IconMap-Backend:

https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=81c50c7d-ca21-414c-b7d9-524410f38339

These URLs cover the permissions each application declares. The OneLake and Eventhouse permissions are requested on demand and are not included - see Permissions requested on demand for the URL form that pre-approves them too.

Option C - one script for everything

Onboard-IconMapTenant.ps1 does the whole onboarding through Microsoft Graph, without opening the product or the URLs, and is idempotent - run it again and it reports what is already in place:

1. Creates the tenant's entry for Azure Storage (and Azure Data Explorer with -IncludeEventhouse) - the prepare your tenant step.
2. Creates the service principals for Tekantis.IconMap and Tekantis.IconMap-Backend.
3. Records the tenant-wide grant for each application's declared permissions - what Option A's prompts and Option B's URLs do.
4. Assigns the backend's one application permission (Microsoft Graph CrossTenantInformation.ReadBasic.All).
5. Pre-approves the on-demand Azure Storage permission for both applications, and Azure Data Explorer for the frontend with -IncludeEventhouse, so the first Lakehouse or Eventhouse does not prompt either.
6. Lists every grant it recorded, for your records.

./Onboard-IconMapTenant.ps1 -TenantId {your-tenant-id} -WhatIf
./Onboard-IconMapTenant.ps1 -TenantId {your-tenant-id} -IncludeEventhouse

It needs only the Azure CLI, so it runs in Azure Cloud Shell (upload the file with the shell's upload button, then run it from ~). Use -WhatIf first to see what it would change. Step 4 needs a Global Administrator or Privileged Role Administrator; a Cloud Application Administrator can run everything else, and the script says so if it has to skip that step.

Option D - Enterprise applications

1. In the Microsoft Entra admin center, go to Enterprise applications.
2. Find Tekantis.IconMap (it appears after the workload is enabled, or after a first sign-in).
3. Open Permissions and choose Grant admin consent for <your organization>.
4. Repeat for Tekantis.IconMap-Backend. If it is not listed yet, its service principal has not been created in your tenant; use the backend URL from Option B instead, which creates it and consents in one step.

This page only ever shows the permissions an application declares, so it cannot pre-approve the on-demand ones.

Scripts

All three are PowerShell, need only the Azure CLI, run in Azure Cloud Shell, support -WhatIf, and are idempotent.

Permissions requested on demand

Azure Storage (OneLake) and Azure Data Explorer (Eventhouse) are not declared on the Icon Map applications and are therefore not covered by the admin-consent URLs above. Icon Map requests them the first time a user touches a feature that needs them:

Basemaps, the Icon Map Catalog, semantic-model sources, Warehouse and SQL endpoint sources need none of these and work as soon as the applications are consented.

In a tenant that allows user consent, the user sees one prompt for the permission and accepts it. To spare users the prompt altogether, an administrator can pre-approve a permission for the whole organization in any of three ways:

1. From the prompt. The first time an administrator uses the feature, tick Consent on behalf of your organization on the prompt. No tooling needed.

2. Admin-consent URL with a scope. The same endpoint as above accepts a scope parameter:

   https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=8ac140d7-88a0-4857-84b4-73c708afd645&scope=https://storage.azure.com/user_impersonation
   https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=81c50c7d-ca21-414c-b7d9-524410f38339&scope=https://storage.azure.com/user_impersonation
   

   For Eventhouse the scope is https://{your-cluster}.kusto.fabric.microsoft.com/user_impersonation; the Graph route below is simpler.

3. Script. Onboard-IconMapTenant.ps1 does this as part of a full onboarding; to add it afterwards, Grant-IconMapResourceConsent.ps1 -TenantId <tenant> -Resource Storage (or -Resource Eventhouse, and -App Backend for the backend) records the grant through Microsoft Graph. It also creates the service entries from Before you consent if they are missing. Azure CLI only, so it runs in Azure Cloud Shell; add -WhatIf to preview.

Note that the Microsoft Entra admin center's Enterprise applications, Permissions, Grant admin consent button is not one of the routes: it grants only the permissions an application declares, and these are deliberately undeclared. The prompt checkbox and the URL with a scope parameter are the two browser-only ways.

If your tenant blocks user consent (see below), one of these is required before anyone can use Lakehouse or Eventhouse sources; users are told so in the product, with the request routed through the admin consent request workflow where your tenant runs one.

Entra user-consent settings

Separately from the above, Entra ID, Enterprise applications, Consent and permissions controls whether ordinary users are allowed to consent for themselves:

• Allow user consent for apps - users see the "Permissions requested" popup and can accept it themselves. Icon Map works, but every user is prompted.
• Do not allow user consent - users see "Need admin approval" and are blocked until an administrator consents. In this configuration tenant-wide admin consent is not optional, it is a prerequisite before anyone can use Icon Map.
• Allow user consent from verified publishers, for selected permissions - the middle setting. Several of Icon Map's permissions are admin-restricted *.All Fabric scopes, so users are still blocked on those.

If your tenant uses the admin consent request workflow, an Icon Map request appears under Admin consent requests for approval.

Verifying the grant

After consenting, check both applications, and check that the grants are recorded for all users rather than one user at a time. In Enterprise applications, Tekantis.IconMap, Permissions, the Admin consent tab should list the frontend permissions above. Tekantis.IconMap-Backend should list the backend set, including the Microsoft Graph application permission. Anything that appears only on the User consent tab was consented by an individual and will still prompt the next person.

The same check from the Azure CLI - a tenant-wide grant has consentType of AllPrincipals, a per-user one has Principal:

az ad sp show --id 8ac140d7-88a0-4857-84b4-73c708afd645 --query id -o tsv
az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals/<objectId>/oauth2PermissionGrants"

Repeat with 81c50c7d-ca21-414c-b7d9-524410f38339 for the backend. Its application permission is recorded separately, as an app role assignment:

az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals/<backendObjectId>/appRoleAssignments"

After granting

• Allow 10-30 minutes for consent to propagate.
• New users should now open Icon Map and use its features without a consent prompt.
• Users who already consented individually are unaffected; they simply stop being asked again.

Troubleshooting

A prompt appeared as soon as the workload was added, before anyone opened a map. Expected: that is the backend application's consent, which Fabric requests when the workload is added. Accept it (on behalf of your organization if you are an administrator). The frontend application prompts once more when the first map opens.

A user is still prompted after admin consent. Entra prompts for any scope not already covered by a tenant-wide grant, even when the app is otherwise consented. Check on the Admin consent tab that the specific permission named in the popup is listed. A popup reading "View all datasets" is Dataset.Read.All, for example, which only semantic-model sources use and which is easy to miss if consent was granted before that feature was in play. Re-running the admin-consent URL picks up the full current set.

Tileset Builder jobs fail, or the Organizational Catalogs tab in a Power BI visual is empty, and there was no popup. The backend application is not consented, or its grant is missing a permission. The backend never prompts. Check Tekantis.IconMap-Backend on the Admin consent tab, or re-run its admin-consent URL.

The popup, or the admin-consent URL, fails with AADSTS650052 "...lacks a service principal for". Your tenant has never used the named service (Azure Storage or Azure Data Explorer) through a third-party application, so Entra has no entry for it yet and cannot record consent. Follow Before you consent: prepare your tenant - one command creates the entry - then try again. Icon Map shows the same explanation, with the command, whenever it hits this.

Lakehouse or Eventhouse sources say "needs administrator consent". Your tenant does not allow users to consent, and the on-demand permission has not been pre-approved. An administrator uses one of the three routes in Permissions requested on demand.

The popup says "unverified" and "This application is not published by Microsoft". Expected. Icon Map is published by Tekantis Limited rather than by Microsoft, and the dialog labels every non-Microsoft publisher that way. Granting admin consent removes the dialog for your users altogether.

The popup says "Need admin approval" instead. Your tenant blocks user consent - see Entra user-consent settings above. An administrator has to consent.

Repeated sign-in or MFA prompts. These are Conditional Access, not consent, and this step doesn't remove them - see Browser & network.

Other Icon Map applications

The two applications above are the Fabric workload. Icon Map deliberately uses separate Entra applications per product surface, each with the minimum permissions for its job, so beyond the workload you only consent to what you deploy:

• Icon Map Desktop (f68c8ff5-476f-4282-a125-47151eb8c6e8) - used by the desktop app's sign-in: OneLake storage access, plus Workspace.Read.All, Item.Read.All and Item.ReadWrite.All for browsing workspaces and deploying maps, and Dataset.Read.All for semantic-model sources. Consent it the same way if you roll out the desktop app; purely local use needs no sign-in at all.
• Icon Map QGIS Connector (ab3aeae9-ced2-40cb-bc4f-9ce4cbb109f3) - used by the QGIS plugin: OneLake storage access, plus Workspace.Read.All, Item.Read.All, Item.ReadWrite.All and Item.Execute.All for the browse and create-map modes. The plugin includes an admin-consent helper; without admin consent, a reduced mode lets users publish by pasting workspace and item IDs using only the user-consentable OneLake permission.
• Icon Map Embed Viewer (31651b7a-301b-4581-871e-100cfd4d2099) - used when you embed a live map in your own internal application and you let the map sign each viewer in. If instead your own application supplies the access token (the more common arrangement), your own Entra application is used and this one is not involved, so there is nothing here to consent. It holds delegated, read-only permissions and nothing more: OneLake storage access, Workspace.Read.All, Item.Read.All and Dataset.Read.All; Azure Data Explorer access for Eventhouse is requested on demand. It deliberately has no Item.ReadWrite.All, because an embedded map is never edited.
• Tekantis.IconMap-Embed - the published-map reader service principal for the public embed service. It is a dedicated application with no API permissions to consent. It gets a read-only OneLake data-access role on the Lakehouse that holds your published maps, granted automatically at publish (see Set up publishing) - never workspace Contributor. Enterprises can supply their own service principal for this instead.

Each application is consented the same way as the workload, substituting its own application ID into the admin-consent URL. You only need to consent the ones you actually deploy.

The full application-by-application permission table, with the reasoning behind each permission, is in the security whitepaper.

Next steps

• Enable tenant settings - the settings that allow this data access.
• Browser & network - other causes of prompts.