All Reports: https://microsoft.github.io/Analytics-Hub/
Cowork Billing: https://microsoft.github.io/Analytics-Hub/cowork-billing/
Found this useful? ⭐ Star this repo to help others discover it!
Dashboard Preview ↓ · What is PAX? ↓ · Get Your Data ↓ · Instructions ↓ · Related Resources ↓ · Email your Admin ↓
This folder contains the AI-in-One Dashboard (Rollup edition) Power BI template, available in two editions: a flexible 3-in-1 auto-detect edition (reads local, SharePoint, or OneLake files) and a SharePoint-only (PBI-SharePoint) edition built for automatic scheduled refresh in the Power BI Service. Both deliver the same comprehensive insights into Microsoft Copilot and Agent adoption, empowering AI and business leaders to make informed decisions about AI implementation, licensing, and enablement strategies — and both load dramatically faster than previous versions thanks to a new pre-processed file format. See Which edition should I download to pick the right one.
This template requires pre-processed rollup files — it cannot read raw Purview CSVs, raw Entra exports, or files from any other unprocessed source. Pointing the template at raw files will result in load failures or blank visuals.
The recommended way to produce these files is the PAX script. See 📦 What is PAX? below for what PAX is and where to get it.
Customers who export raw Purview and Entra data through a method other than PAX can use the standalone processor script in the
scripts/folder to produce the same rollup files. See the ⚙️ Standalone processor section below.
See the dashboard in action:
This Rollup release ships in two editions that share the exact same pages, visuals, and numbers. They differ only in where they read your input files from and whether the Power BI Service can refresh them on a schedule. Pick one:
| Rollup Edition (3-in-1, auto-detect) | Rollup Edition — PBI-SharePoint | |
|---|---|---|
| ⬇️ Download | AIO Dashboard - Rollup Edition | AIO Dashboard - Rollup Edition - PBI-SharePoint |
| Input file locations | Local path, SharePoint URL, or OneLake URL — auto-detected for each parameter | SharePoint URLs only (each input is validated as a SharePoint URL) |
| Best for | Power BI Desktop analysis, quick local trials, OneLake/Fabric, or any mix of the above | Publishing to the Power BI Service when you want automatic scheduled refresh |
| Scheduled refresh in the Service | ❌ Not supported (see below) | ✅ Supported — no Gateway needed |
| Manual / on-demand refresh | ✅ In Desktop (and on-demand in the Service) | ✅ |
The Power BI Service decides whether it can schedule a dataset by statically inspecting how it connects to its sources — before it ever runs the query. A source whose location is computed at runtime — which is exactly how the 3-in-1 edition stays flexible enough to accept a local path or a SharePoint URL or a OneLake URL — is classified as a dynamic data source, and the Service disables scheduled refresh for the entire dataset when one is present. No M arrangement avoids this while keeping that flexibility; it's a platform rule, not a template bug.
The PBI-SharePoint edition gives up that flexibility on purpose: every input is read through a single, static SharePoint connector that the Service is happy to schedule. That one change is the only difference under the hood — the report itself is identical.
Rule of thumb
- Exploring in Power BI Desktop, or your files are local / on OneLake → 3-in-1 edition.
- You want the report to refresh itself on a schedule in the Service and your files are on SharePoint → PBI-SharePoint edition.
- Your files are on OneLake/Fabric and you need scheduled refresh → use the dedicated Fabric edition in
Classic Editions/3. Fabric/, a Fabric-native thin client.
⚠️ Important usage & compliance disclaimer
Please note:
While this tool helps customers better understand their AI usage data, Microsoft has no visibility into the data that customers input into this template/tool, nor does Microsoft have any control over how customers will use this template/tool in their environment.
Customers are solely responsible for ensuring that their use of the template tool complies with all applicable laws and regulations, including those related to data privacy and security.
Microsoft disclaims any and all liability arising from or related to customers' use of the template tool.
Experimental Template Notice: This is an experimental template with audit logs as the primary source. The audit logs from Microsoft Purview are intended to support security and compliance use cases. While they provide visibility into Copilot and Agent interactions, they are not intended to serve as the sole source of truth for licensing or full-fidelity reporting on Copilot or Agent activity. For the most accurate and reliable usage insights, users are encouraged to refer to data from the Microsoft 365 Admin Center and Viva Insights. Currently available in English only.
Show this section (click to expand)
PAX stands for Portable Audit eXporter. It's a free, open-source PowerShell script from the Microsoft Copilot Growth ROI Advisory team that:
- Pulls Microsoft 365 Copilot audit data out of Microsoft Purview
- Pulls user, organization, and licensing data out of Microsoft Entra and the Microsoft 365 Admin Center (MAC)
- Pull additional agent details from Agent 365
- Writes the results as CSV files — locally, to SharePoint, or to OneLake/Fabric
- When run with one of the rollup switches (see below), it also pre-processes the Purview and Entra/MAC CSVs into the exact format this dashboard template expects. The optional Agent 365 data does not need any pre-processing for use in this dashboard.
PAX repo (bookmark this): https://github.com/microsoft/PAX
Throughout this README, "run PAX" means running the script from that repo. PAX is the recommended (and currently only supported) way to produce input files for this dashboard.
Show this section (click to expand)
If you've used a previous version of the AI-in-One Dashboard, here's what changed and why it matters.
In previous versions, Power BI did all of the heavy lifting itself. It opened large raw Purview audit files (often hundreds of megabytes — sometimes gigabytes), picked apart the messy nested data inside each row, looked up who each user was, figured out their licenses, and computed dozens of derived fields on the fly. For a small tenant, this was fine. For real-world tenants, this meant:
- Power BI Desktop loads of an hour or more
- Frequent "out of memory" errors
- Refresh failures and timeouts in the Power BI Service
- Dashboards that were effectively unusable for large organizations
All of that prep work now happens once, ahead of time, in a small Python helper that runs as an embedded part of the PAX script. By the time Power BI ever opens the file, the hard work is already done. Power BI just reads a clean, ready-to-use file and shows you the dashboard.
The Python helper does the following, in order:
- Reads the raw Purview audit file and the Entra/MAC user + licensing file
- Expands the raw audit data into its full detail (one row per interaction × prompt × resource)
- Merges in user, organization, and license information
- Pre-calculates a long list of fields that the dashboard used to compute on the fly (things like agent identifiers, behavior categories, value outcomes, activity dates, etc.)
- Groups the result back together at exactly the level the dashboard needs
A note on file size: the final rollup file usually has more rows than the raw input (because the raw was packed/compressed and we expanded it before regrouping). That sounds counterintuitive — but every row in the rollup file is already shaped exactly the way the dashboard wants it, so Power BI doesn't have to do any of the expensive work itself. And the processed files are only a fraction of their original size!
- Purview audit data tells you what people did with Copilot
- Entra + MAC user/license data tells you who they are and what licenses they have
The Python helper joins these once, upstream, so Power BI doesn't have to do that join across millions of rows every time the dashboard refreshes.
- Typically ~80%+ reduction in Power BI load times
- Reliable scheduled refresh in the Power BI Service
- No more wrestling with timeouts on large tenants
- Same pages, same visuals, same numbers — just calculated upstream so PBI doesn't have to
Show this section (click to expand)
- Comprehensive visibility into M365 Copilot, unlicensed Copilot Chat, and Agent usage across your organization
- User engagement tracking over time to identify adoption patterns and trends across all Copilot surfaces
- Data-driven insights to optimize AI investments, license allocation, and employee enablement
- Customizable views to segment data by department, role, or other organizational dimensions
Show this section (click to expand)
- Make informed AI and Microsoft Copilot investment decisions using comprehensive usage data and analytics consolidated in one place
- Identify Copilot and Agent adoption champions and areas needing additional enablement
- Optimize enablement and change management efforts based on actual usage patterns across M365 Copilot, unlicensed Copilot Chat, and Agents
- Accelerate AI readiness, adoption, and impact across the organization — from licensed Copilot experiences to emerging Agent capabilities
Show this section (click to expand)
Reminder: This template only consumes the rollup files produced by PAX. If you (or your admin) try to point it at a raw Purview audit CSV or a manually-exported Entra users CSV, it won't work.
PAX exposes two switches that produce the file format this template needs:
| Switch | What it does | When to use it |
|---|---|---|
-Rollup |
Runs the rollup post-processor and produces only the rolled-up output files. The raw intermediate CSVs are deleted. | Recommended default. Smallest footprint. Use this if the dashboard is the only thing you'll use the data for. |
-RollupPlusRaw |
Same as -Rollup but keeps the raw Purview and Entra CSVs alongside the rollup output. |
Use this if you also want the raw data for other purposes (custom reporting, archival, troubleshooting). |
The two switches are mutually exclusive — pick one.
After PAX finishes, you'll have these files (filenames are timestamped automatically):
| File | What it is | Required by template? |
|---|---|---|
Purview_Audit_..._Interactions.csv |
The main "what happened" file — rolled-up Copilot interactions | ✅ Required |
EntraUsers_MAClicensing_..._Users.csv |
The "who they are" file — user, organization, and license info | ✅ Required |
Agent365_....csv |
Agent catalog snapshot (only produced if you also pass -IncludeAgent365Info) |
Optional but highly recommended |
Agent 365 data is a point-in-time catalog snapshot of the agents registered in your tenant (name, host product, developer, status, version, etc.). Unlike Purview audit data and Entra/MAC user data, this file is not transformed by the embedded Python rollup processor — PAX produces it as a straight passthrough using the same column shape the dashboard expects.
Because there's no processor step involved, this is the one and only input file the dashboard accepts directly from the Microsoft 365 Admin Center's manual UI export. Purview audit data and Entra/MAC user data must go through a processor step — either PAX or the standalone processor script in the scripts/ folder. See the ⚙️ Standalone processor section below for the non-PAX path.
You have two options for getting the Agent 365 file:
Option 1 — let PAX produce it
Add the -IncludeAgent365Info switch to your PAX command. PAX will produce Agent365_<timestamp>.csv alongside the rollup files. This is the simplest path and keeps all three input files together. (-IncludeAgent365Info is fully compatible with -Rollup and -RollupPlusRaw.)
Note: producing the Agent 365 file requires additional permissions — typically AI Admin or Global Reader — on top of the Purview/Entra permissions PAX already needs. If your admin doesn't have these, Option 2 below works just as well.
Option 2 — manual export from the Microsoft 365 Admin Center
Use this path if you don't want to run PAX with elevated Agent 365 permissions, or if a different person owns Agent 365 governance in your org. Steps:
- Go to admin.microsoft.com → in the left nav, Agents → All Agents
- Click Export in the toolbar (the button is sometimes labeled "Export to Excel", but the file it produces is CSV — see Microsoft Learn: Manage agent registry)
- Save the
.csvto a known location - Point the
Agent 365parameter in the PBIT at that CSV
💡 Tip — for scheduled refresh (PBI-SharePoint edition): the PBI-SharePoint edition requires all three input files to be SharePoint URLs. Upload your manually-exported Agent 365 CSV to the same SharePoint folder as your Interactions and Org Data files so all three parameters point at SharePoint. See the mixed-source caveat further down.
These are the most common patterns. Your admin can copy-paste them, adjusting paths/URLs for your environment. (See the PAX repo for the full set of switches and options.)
1. Local CSVs — single-user / quick try
.\PAX_Purview_Audit_Log_Processor.ps1 -Rollup -IncludeAgent365Info -OutputPath "C:\Data\PAX"2. SharePoint — recommended for scheduled refresh (no Gateway required)
.\PAX_Purview_Audit_Log_Processor.ps1 -Rollup -IncludeAgent365Info `
-OutputPath "https://contoso.sharepoint.com/sites/CopilotAnalytics/Shared Documents/PAX Output"Do NOT copy the URL from your browser's address bar. That URL includes view parameters (
?...), session tokens, and a path layout that won't work for either PAX output or the PBIT parameters.Do this instead — for a folder URL (used as PAX
-OutputPath):
- In SharePoint, navigate to the document library and into the target folder
- Click the three-dot menu (
⋮) next to the folder name, or right-click the folder → Details- In the details pane on the right, scroll to Path
- Click the 📋 copy icon next to the path
- Paste somewhere — you'll get a clean URL like
https://contoso.sharepoint.com/sites/CopilotAnalytics/Shared Documents/PAX Output(no?..., no view state)For a file URL (used in the PBIT parameters):
- Navigate into the folder so you see the file in the list
- Click the three-dot menu (
⋮) next to the file name → Details- Copy the Path the same way
- Paste — you should get something ending in
.../filename.csvIf your URL looks like
https://contoso.sharepoint.com/:x:/r/sites/.../filename.csv?d=w...&csf=1&web=1&e=...— that's the browser address bar URL (or a "Copy link" share link). It will not work. Go back and use the Details pane Path instead.
3. OneLake / Fabric — large tenants, multi-year retention
.\PAX_Purview_Audit_Log_Processor.ps1 -Rollup -IncludeAgent365Info `
-OutputPath "https://onelake.dfs.fabric.microsoft.com/<workspace>/<lakehouse>.Lakehouse/Files/PAX"If you have Fabric capacity, the recommended pattern is to run PAX inside an Azure Container Apps Job on a schedule, writing the rollup files directly to a Lakehouse in OneLake. The Power BI dataset then refreshes against OneLake via SSO with no Gateway, no laptop dependency, and no manual file-copy step.
Everything you need to set this up is in the fabric_resources/ folder of the PAX repo:
👉 https://github.com/microsoft/PAX → fabric_resources/
That folder contains:
- A Dockerfile for building the PAX container image
- Detailed step-by-step instructions for deploying the Azure Container Apps Job
- Prereq checklists (capacity, identity, RBAC, secret management)
- Configuration templates
If you're a Fabric customer, do not skip this folder — it has the canonical Fabric deployment guidance.
Show this section (click to expand)
The scripts/ folder in this folder contains a Python script that produces the same two rollup files this dashboard requires — without needing PAX. Use this path if you export raw Purview audit data and Entra/MAC user data through your own tooling, portal exports, or an alternative script rather than through PAX.
Note: This processor handles the Purview interactions file and the Entra/MAC users file only. It does not produce the Agent 365 file. For Agent 365 data, see the 🤖 Agent 365 section above.
- Python 3.9 or later
- The
orjsonpackage is optional but recommended for faster JSON parsing:The script falls back to the Python standard librarypip install orjsonjsonmodule iforjsonis not installed.
Two input files are required. Both must be CSV format.
This is the raw audit log export from Microsoft Purview. Export it from the Microsoft Purview compliance portal → Audit → search/export.
The script filters the file automatically — only CopilotInteraction operation records are processed; all other record types are skipped.
| Column | Required? | Notes |
|---|---|---|
AuditData |
✅ Required | The JSON blob column that Purview includes in every audit export. All Copilot interaction detail is parsed from inside this column. If this column is absent, the script will produce no output. |
Operation or Operations |
Used for filtering | Used to identify CopilotInteraction records when the value is not already inside the AuditData JSON. Purview exports typically include one of these. |
All other columns in the Purview export are ignored — the script reads only AuditData and Operation/Operations.
This file is not a direct export from a single portal. It is a combined file you assemble by joining two separate exports:
- Microsoft Entra ID user export — provides the user list with UPN, display name, department, job title, etc.
- Microsoft 365 Admin Center (MAC) licensing export — provides the per-user Copilot license assignment column
You must add the license column from the MAC export into the Entra user export (for example, using Excel or Power Query) before passing the file to the script. If no recognized license column is present, the script will still process the file but every user will be tagged as Unlicensed.
| Column | Required? | Accepted column names | Notes |
|---|---|---|---|
| User Principal Name | ✅ Required | userPrincipalName, upn, personId (case-insensitive) |
Used to join Purview audit records to user data. Rows with a blank UPN are still written to the Users output but will not join to any audit activity. |
| Copilot license flag | ✅ Strongly recommended | Has license, Has License, hasLicense, HasLicense, Has Copilot License, Has Copilot license, HasCopilotLicense, Has Copilot License Assigned, Has Copilot license assigned, isUser |
Any truthy value (Yes, True, Y, 1) is treated as licensed; everything else is unlicensed. If the column is missing entirely, all users default to unlicensed. |
| Department | ✅ Required | Any casing of department, organization, or organisation — spaces, hyphens, and underscores in the column name are ignored when matching |
Renamed to Organization in the output. Used for org-level segmentation in the dashboard. |
| Job title | ✅ Required | Any casing of jobtitle or job title — spaces, hyphens, and underscores in the column name are ignored when matching |
Renamed to JobTitle in the output. |
| All other columns | Optional | Any | All other columns in your input file are passed through to the Users output as-is. |
| Argument | Required? | Description |
|---|---|---|
--purview <path> |
✅ Required | Path to the raw Purview audit log CSV |
--entra <path> |
✅ Required | Path to the Entra users CSV |
--out-dir <path> or -o <path> |
Optional | Directory where output files are written. Defaults to the same directory as the Purview input file |
--quiet or -q |
Optional | Suppresses progress output. Useful in scheduled or automated contexts |
Two files are written to the output directory, named automatically based on your input filenames and a run timestamp:
| Output file | What it is | Dashboard parameter |
|---|---|---|
<purview-filename>_Interactions_<timestamp>.csv |
Rolled-up Copilot interactions fact table | Copilot Interactions File |
<entra-filename>_Users_<timestamp>.csv |
Users and licensing dimension table | Org Data File |
Point the corresponding dashboard parameters at these two output files exactly as you would with PAX-produced files.
Run the .py file found in the scripts/ folder. In the examples below, replace scripts/<processor>.py with the actual filename.
Basic — output files are written to the same folder as the Purview input
python scripts/<processor>.py --purview "C:\Data\Purview_Audit_20260510.csv" --entra "C:\Data\EntraUsers_20260510.csv"
With an explicit output directory
python scripts/<processor>.py --purview "C:\Data\Purview_Audit_20260510.csv" --entra "C:\Data\EntraUsers_20260510.csv" --out-dir "C:\Data\Rollup Output"
Quiet mode — suppress progress output (useful in scheduled tasks)
python scripts/<processor>.py --purview "C:\Data\Purview_Audit_20260510.csv" --entra "C:\Data\EntraUsers_20260510.csv" --out-dir "C:\Data\Rollup Output" --quiet
If you use PAX's -AppendFile switch to accumulate a growing raw Purview CSV over time, run the standalone processor against that accumulated file to produce a fresh rollup whenever you need to refresh the dashboard. See the 📚 Multi-month history section below for the full pattern, including the recommended commands.
Show this section (click to expand)
Many customers want months of trailing data in this dashboard, not just a single PAX run. Here's the current state of how to get there.
PAX has an -AppendFile switch that appends new rows to an existing CSV instead of writing a fresh timestamped file. It's designed for exactly this scenario — running PAX on a schedule, accumulating audit history into one growing file over time. Key facts:
- The target file must already exist. Run PAX once without
-AppendFileto create the initial seed file, then use-AppendFile <name>on every subsequent run. - CSV headers must match exactly between the existing file and the new run. PAX validates this and exits with a clear error on mismatch.
- Only Purview audit data is appendable.
-AppendFileis incompatible with-IncludeUserInfo/-OnlyUserInfobecause Entra/MAC user+licensing data is a point-in-time snapshot — appending old user state on top of new state would corrupt the picture. Same logic applies to Agent 365. - Each run still produces fresh timestamped log / telemetry / metrics files alongside the appended output.
This is the honest answer: as of today, PAX blocks -AppendFile when -Rollup or -RollupPlusRaw is used, and exits with an error. The rollup processor assigns INT surrogate keys (Message_Id, ThreadId, UserKey) per run, so appending rolled-up rows would produce mismatched keys and a broken file.
Rollup-aware appending with the standalone processor: Use the standalone processor in the
scripts/folder for this pattern:
- Use PAX with
-AppendFile(no-Rollup) to accumulate a growing raw Purview audit CSV over time- Run that accumulated raw file through the standalone processor to produce a freshly-keyed rollup file the dashboard can consume
This gives you the best of both worlds — incremental daily/weekly raw appends from PAX, plus a clean dashboard-ready rollup whenever you need to refresh the report. See the ⚙️ Standalone processor section below for usage details.
Until rollup-append lands, use one of these patterns:
Pattern A — full re-run of a rolling window (simplest, recommended for most)
Schedule PAX with -Rollup over a rolling window (e.g. last 60 or 90 days, depending on your Purview retention). Each run replaces the previous rollup output. Power BI just refreshes against the latest file. Trade-off: every run does a full export, which on large tenants takes longer than an incremental append would.
# Example: weekly run, last 90 days
.\PAX_Purview_Audit_Log_Processor.ps1 -Rollup -IncludeAgent365Info `
-StartDate (Get-Date).AddDays(-90).ToString('yyyy-MM-dd') `
-EndDate (Get-Date).ToString('yyyy-MM-dd') `
-OutputPath "https://contoso.sharepoint.com/sites/CopilotAnalytics/Shared Documents/PAX Output"Pattern B — accumulate raw with -AppendFile now, convert to rollup when the standalone processor ships
If you want to start building up multi-month raw history immediately so you're ready the day the standalone processor releases, run PAX without -Rollup and use -AppendFile to grow a single raw Purview CSV over time.
# Step 1 (run ONCE) — create the initial seed file
.\PAX_Purview_Audit_Log_Processor.ps1 -StartDate 2026-02-01 -EndDate 2026-02-28 `
-ActivityTypes CopilotInteraction -CombineOutput -OutputPath "C:\Data\PAX"
# Step 2 (run on a schedule) — append each new day/week into the same file
.\PAX_Purview_Audit_Log_Processor.ps1 -StartDate 2026-03-01 -EndDate 2026-03-07 `
-ActivityTypes CopilotInteraction -CombineOutput `
-AppendFile "Purview_Audit_UsageActivity_CombinedActivityTypes_<seed-timestamp>.csv" `
-OutputPath "C:\Data\PAX"Important points for Pattern B:
- The accumulated raw file produced this way cannot be opened by this dashboard directly — it must be processed first.
- Run the standalone processor in the
scripts/folder against the accumulated raw file to produce dashboard-ready rollup output. See the ⚙️ Standalone processor section below for usage details. - For current dashboards, also do a Pattern A run in parallel so you have a usable rollup file while you build up your raw history.
- Don't forget: Entra/MAC user data and Agent 365 data still need to be fresh point-in-time exports — they cannot be appended.
Show this section (click to expand)
- Download and open one of the two editions in Power BI Desktop (see Which edition should I download):
AIO Dashboard - Rollup Edition - 2026-06-25.pbit— accepts local, SharePoint, or OneLake files; best for Desktop and manual refreshAIO Dashboard - Rollup Edition - PBI-SharePoint - 2026-06-25.pbit— accepts SharePoint URLs only; use this one if you want scheduled refresh in the Service
- Fill in the three parameters when prompted
- Click Load
| Parameter | What to paste in | Required? |
|---|---|---|
| Copilot Interactions File | The full path or URL to your Purview_Audit_..._Interactions.csv |
✅ Required |
| Org Data File | The full path or URL to your EntraUsers_MAClicensing_..._Users.csv |
✅ Required |
| Agent 365 (highly recommended) | The full path or URL to your Agent365_....csv, or leave blank to skip |
Optional |
PBI-SharePoint edition: each parameter must be a SharePoint URL — the template checks that the value starts with
https://and points at a SharePoint site. Paste a local path or OneLake URL into that edition and you'll get a friendly message telling you to use the 3-in-1 edition instead. The auto-detection described below applies to the 3-in-1 (auto-detect) edition.
Each parameter accepts whichever of these matches where your file lives. The template figures out the rest automatically:
- Local file path — e.g.
C:\Data\PAX\Purview_Audit_20260510_120000_Interactions.csv - SharePoint URL — e.g.
https://contoso.sharepoint.com/sites/CopilotAnalytics/Shared Documents/PAX Output/Purview_Audit_20260510_120000_Interactions.csv - OneLake URL — e.g.
https://onelake.dfs.fabric.microsoft.com/<workspace>/<lakehouse>.Lakehouse/Files/PAX/Purview_Audit_20260510_120000_Interactions.csv
The template is tolerant of common copy-paste mistakes:
- Surrounding quotes (single or double, including "smart quotes" from email clients) are stripped automatically
- URL-encoded spaces (
%20) and trailing query strings (?...) are handled - SharePoint URLs are matched case-insensitively and tolerate trailing slashes
⚠️ SharePoint URL gotcha — the URL you paste into these parameters must be the document path from the SharePoint details pane, NOT the URL in your browser's address bar and NOT a "Copy link" share link. See How to get the correct SharePoint URL above for step-by-step instructions.
Technically yes — each of the three parameters resolves its backend independently, so the template will accept (say) a SharePoint URL for Interactions, a SharePoint URL for Org Data, and a local path for Agent 365. In practice, mixing source types is awkward and we recommend against it:
- Power BI Desktop will throw
Formula.Firewallerrors when combining different source types unless you set Privacy → "Combine data without privacy" - Power BI Service requires you to configure credentials separately for each source type, and Privacy levels must be set consistently
- Any local-path source requires an On-premises Data Gateway in the Power BI Service — but SharePoint and OneLake do not
Strong recommendation: keep all three files in the same storage location. The most common mismatch is a manually-exported Agent 365 file sitting on someone's laptop while the Purview/Entra rollup files live on SharePoint or OneLake. Easy fix: upload the Agent 365 CSV to the same SharePoint/OneLake folder.
- "File not found" /
DataSource.Error— double-check the path or URL is exactly what PAX wrote. Local paths must be absolute (e.g.C:\Data\file.csv, not.\file.csv). For SharePoint, copy the full document URL. Formula.Firewall: Query references other queries…— privacy-level mismatch when combining sources. In Power BI Desktop: File → Options → Current File → Privacy → Combine data without privacy. In Power BI Service: dataset Settings → Data source credentials → set Privacy: Organizational (or None) for SharePoint and OneLake sources.- Blank visuals after load — the most common cause is that the input file is not a PAX rollup file. Confirm the filename matches the
..._Interactions.csv/..._Users.csvpattern and was produced by PAX with-Rollupor-RollupPlusRaw.
Show this section (click to expand)
Automatic scheduled refresh in the Power BI Service is supported only by the PBI-SharePoint edition, with all three input files stored on SharePoint. The 3-in-1 (auto-detect) edition cannot be scheduled in the Service — its runtime-resolved connector is treated as a dynamic data source, which disables scheduled refresh for the entire dataset (a Power BI platform rule — see Why are there two editions). You can still refresh the 3-in-1 manually in Power BI Desktop. For OneLake/Fabric scheduled refresh, use the Fabric edition in
Classic Editions/3. Fabric/.
Once the dashboard works in Power BI Desktop, publish the report to a Power BI Service workspace and configure scheduled refresh so it stays current automatically.
For SharePoint-stored files — the PBI-SharePoint edition (recommended for most customers — no Gateway needed)
- Publish the PBI-SharePoint edition report to a workspace from Power BI Desktop (
File → Publish → Publish to Power BI) - In Power BI Service, go to the dataset → Settings → Data source credentials
- Click Edit credentials for the SharePoint source and sign in with OAuth2 using an account that can read the SharePoint folder
- Set the Privacy level to Organizational (so PBI is allowed to combine your sources)
Cross-tenant SharePoint: if the SharePoint site holding your files is in a different tenant than your Power BI Service, sign in here with a guest/B2B account that has access to those files. The scheduled-refresh toggle stays grayed out until valid credentials are saved for every source — saving them here is what enables it. Conditional Access / MFA policies on the file-hosting tenant can block the unattended token renewal that scheduled refresh relies on; if the toggle won't enable after you sign in, that's the likely cause (copy the files into your own tenant, or use an account not subject to those policies).
- Expand Scheduled refresh and turn it on. Pick a cadence (Daily / Weekly) that lines up with how often PAX runs
- Tip: have your admin configure PAX to overwrite the same filename each run (rather than a new timestamped file every time). This way the dataset just refreshes against a stable URL — no template edits needed
- Limits to know:
- Power BI Pro: up to 8 scheduled refreshes per day
- Premium / PPU: up to 48 scheduled refreshes per day
- Make sure PAX finishes writing the file before your scheduled refresh window starts
For OneLake scheduled refresh, use the Fabric edition. The 3-in-1 (auto-detect) edition reads OneLake files in Power BI Desktop, but it can't be scheduled in the Service (dynamic data source — see Why are there two editions), and the PBI-SharePoint edition only accepts SharePoint URLs. For Service-side scheduled refresh against OneLake, use the Fabric thin-client edition in
Classic Editions/3. Fabric/. The steps below describe that Fabric pattern.
- Publish the
.pbixto a Fabric-enabled workspace (PPU or Fabric capacity required) - OneLake credentials are handled automatically via SSO if the workspace is in the same tenant — usually no manual credential setup needed
- Configure scheduled refresh the same way as above
- Recommended pattern: schedule PAX to run via an Azure Container Apps Job → PAX writes the rollup files directly to OneLake → the Power BI dataset's scheduled refresh fires shortly after.
🏭 Fabric customers \u2014 use the
fabric_resources/folder in the PAX repo. It has the Dockerfile, detailed deployment instructions, prereq checklists, and configuration templates for setting up the Azure Container Apps Job end-to-end. Do not try to piece this together from scratch \u2014 the resources folder is the canonical guide.👉 https://github.com/microsoft/PAX →
fabric_resources/
Power BI Service can't reach files on your laptop without an On-premises Data Gateway. If you're going to schedule refresh, use SharePoint or OneLake instead — both work without a Gateway and are simpler to maintain.
Show this section (click to expand)
Once the dashboard loads:
- Walk through the report pages — verify data loaded correctly and that filters/slicers behave as expected
- Customize for your organization — adjust colors/branding, organizational hierarchies, default date ranges, and bookmarks
- Publish and share — publish to Power BI Service, optionally configure Row-Level Security, then share via workspace access or apps
- Set up subscriptions — email subscriptions for executives who want regular updates without opening the dashboard
- 🔄 Refresh schedule — match it to how often PAX runs (typically weekly or daily)
- 🔒 Row-Level Security — restrict sensitive data by department or role if needed
- 📊 Usage tracking — monitor dashboard usage in Power BI Service to understand which views resonate
- PAX (Purview Audit eXporter) — the script that produces this template's input files: https://github.com/microsoft/PAX
This release ships two editions, both built for the same PAX rollup file format:
| Edition | File | Input locations | Scheduled refresh in the Service |
|---|---|---|---|
| Rollup Edition (3-in-1, auto-detect) | AIO Dashboard - Rollup Edition - 2026-06-25.pbit |
Local / SharePoint / OneLake | Desktop / manual only |
| Rollup Edition — PBI-SharePoint | AIO Dashboard - Rollup Edition - PBI-SharePoint - 2026-06-25.pbit |
SharePoint only | ✅ Supported |
As long as you're running a current version of PAX (v1.11.1+) with -Rollup (or -RollupPlusRaw), the output is compatible with both editions.
This project is licensed under the MIT License — see the LICENSE.md file for details.
Please see SECURITY.md for information on reporting security vulnerabilities.
📧 Before you begin, your IT admin needs to export data from Purview, Entra, and M365 Admin Center. This pre-written email covers all required data sources, field names, admin roles, permissions, and export steps — everything your admin needs in one click.
Found this useful? ⭐ Star this repo to help others discover it!
That's it! 🚀