How to Schedule and Export PDF Reports with Dynamic Parameters for Multiple Sentinel Workspace IDs

Hi noob456 ,

Thank you for reaching out to Microsoft Community.

You can try this approach to generate standardized PDF reports from Power BI that reflect data from Microsoft Sentinel workspaces hosted in different Azure Active Directory (AAD) tenants.

Step 1: Design Parameterized Power BI Report

Begin by designing a Power BI report that accepts input parameters such as Workspace ID, Tenant Name, or other identifiers used to distinguish Sentinel data sources. This can be done using Power BI Query Parameters or Power Query M parameters. Within the report’s queries, use conditional logic to connect to the appropriate Microsoft Sentinel workspace based on the parameter values.
Once the report is fully functional and tested, publish it to the Power BI Service either to a single central tenant or separately to each tenant where Sentinel data resides, depending on your architecture and permission model.

Step 2: Set Up Multi-Tenant Authentication

To programmatically access Sentinel data and perform actions like report export or dataset refresh, you'll need to authenticate across multiple Azure AD tenants. The recommended approach is to register a Service Principal (App Registration) in each tenant:

Assign required API permissions to access Microsoft Sentinel data via Azure Monitor or Log Analytics API.
Grant Power BI service permissions (such as Dataset.Read.All, Report.Read.All, and Workspace.Read.All).
Use client credentials flow (OAuth 2.0) to acquire tokens scoped to each tenant.
Store tenant-specific credentials securely using Azure Key Vault or environment variables, especially when automating from Azure Functions or other services.

Step 3: Automate Dataset Refresh

If the Power BI report relies on live Sentinel data, you should initiate a dataset refresh before exporting the report to ensure accuracy.

Use the Power BI REST API's dataset refresh endpoint:

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/refreshes

For each tenant and associated workspace, issue a refresh request. Optionally, include logic to wait for the refresh to complete or poll for status before continuing to the export phase.

Step 4: Export Power BI Report to PDF with Parameters

Once the dataset is refreshed or if a refresh is not needed, use the Power BI Export API to generate a PDF report.
In the request body, include parameter values or filters to tailor the report output to a specific Microsoft Sentinel workspace. This ensures each report reflects only the data relevant to its intended tenant or workspace.

Step 5: Implement Automation Script or Azure Function
Develop an automation script or serverless function (using PowerShell, Python, or C#) that orchestrates the workflow:

Maintain a list of tenants and their corresponding Sentinel workspace IDs.
Authenticate to each tenant using the registered Service Principal and retrieve access tokens. For each tenant:

Refresh the dataset.
Trigger the PDF export with the correct parameter values.
Save the exported PDF to a central repository (e.g., Azure Blob Storage).
This script should be robust enough to handle token expiration, retry on failure, and logging for auditing purposes.

Step 6: Schedule and Monitor Automation

To run this process regularly e.g., daily or weekly:

Deploy the automation to Azure Functions with a Timer trigger.
Alternatively, use Azure Logic Apps to design a no-code workflow that runs on a schedule and calls your export function/script.
Azure Automation Runbooks can also be used if your organization prefers a more script-centric model with native integration into Azure Monitor and Key Vault.
Add monitoring and alerting (e.g., via Application Insights or email alerts) to capture any failed report exports or authentication issues.

Hope this helps.
Warm regards,
Chaithra E.