From 06e72fa01eeccdfbbd7c08fe76d3bb92c3bc08f8 Mon Sep 17 00:00:00 2001
From: Michael Flanakin <flanakin@live.com>
Date: Wed, 28 Oct 2026 18:45:37 +0000
Subject: [PATCH 1/2] test(power-bi): validate PBIT templates statically and in
 Power BI Desktop

Add PowerBITemplates unit tests that read each built PBIT and check the
parameters, empty data sources, demo strings, tables, and gzip support, and
skip when the templates are not built. Add Test-PowerBITemplates, which opens
each PBIT in Power BI Desktop on Windows and checks the parameter prompt, and
a -ValidateTemplates switch on Package-PowerBI to run it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../Tests/Unit/PowerBITemplates.Tests.ps1     | 354 +++++++++++
 src/scripts/Package-PowerBI.ps1               |  17 +
 src/scripts/README.md                         |  40 ++
 src/scripts/Test-PowerBITemplates.ps1         | 570 ++++++++++++++++++
 4 files changed, 981 insertions(+)
 create mode 100644 src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
 create mode 100644 src/scripts/Test-PowerBITemplates.ps1

diff --git a/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1 b/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
new file mode 100644
index 000000000..80538de02
--- /dev/null
+++ b/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
@@ -0,0 +1,354 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    Validates the built Power BI templates (PBIT) without opening Power BI Desktop.
+
+    A PBIT is a ZIP file. Its DataModelSchema part holds the parameters and Power Query (M)
+    queries a person sees when they open the template, so most of what is checked by hand today
+    (the parameter prompt, no demo data source, gzip support) can be read from it. This runs on
+    any platform.
+
+    The templates are build output (release/pbit, or release/PowerBI-kql.zip and
+    release/PowerBI-storage.zip). When none of them have been built, every test is skipped with
+    the command that builds them instead of failing, so unit CI does not depend on a build. When
+    some are built and some are missing, the missing ones fail.
+
+        ./src/scripts/Build-PowerBI.ps1 -NoPbip
+
+    Expected values come from the sources the build reads (src/power-bi/reports.json and the
+    shared datasets), so a deliberate change there does not need a change here.
+
+    Opening the templates in Power BI Desktop is covered by src/scripts/Test-PowerBITemplates.ps1.
+#>
+
+BeforeDiscovery {
+    $srcDir = (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName
+    $reports =(Get-Content (Join-Path $srcDir 'power-bi/reports.json') -Raw | ConvertFrom-Json -Depth 10).reports.PSObject.Properties.Name
+
+    # One entry per template that should exist, whether it was built or not
+    $templates = foreach ($type in 'kql', 'storage')
+    {
+        foreach ($name in $reports)
+        {
+            @{ Name = $name; Type = $type; Label = "$name.$type" }
+        }
+    }
+}
+
+BeforeAll {
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+
+    $script:srcDir = (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName
+    $script:releaseDir = Join-Path (Split-Path $script:srcDir -Parent) 'release'
+    $script:powerBiDir = Join-Path $script:srcDir 'power-bi'
+    $script:notBuilt = 'Power BI templates are not built. Run ./src/scripts/Build-PowerBI.ps1 -NoPbip to build them.'
+
+    # Reuse the build's own allowlist and TMDL name logic instead of copying it
+    $helpers = 'Resolve-Allowlist', 'ConvertFrom-TmdlDeclaration'
+    $ast = [System.Management.Automation.Language.Parser]::ParseFile((Join-Path $script:srcDir 'scripts/Build-PowerBI.ps1'), [ref]$null, [ref]$null)
+    $ast.FindAll({ param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $helpers -contains $node.Name }, $false) `
+    | ForEach-Object { . ([scriptblock]::Create($_.Extent.Text)) }
+
+    # Find the built templates: release/pbit first, then the release ZIP files
+    $script:extractedDir = $null
+    $script:templatePath = @{}
+    $pbitDir = Join-Path $script:releaseDir 'pbit'
+    foreach ($file in @(Get-ChildItem (Join-Path $pbitDir '*.pbit') -ErrorAction SilentlyContinue))
+    {
+        $script:templatePath[$file.BaseName] = $file.FullName
+    }
+    if ($script:templatePath.Count -eq 0)
+    {
+        foreach ($type in 'kql', 'storage')
+        {
+            $zip = Join-Path $script:releaseDir "PowerBI-$type.zip"
+            if (-not (Test-Path $zip)) { continue }
+
+            if (-not $script:extractedDir)
+            {
+                $script:extractedDir = Join-Path ([System.IO.Path]::GetTempPath()) "ftk-pbit-$([guid]::NewGuid().ToString('N'))"
+                New-Item $script:extractedDir -ItemType Directory | Out-Null
+            }
+            [System.IO.Compression.ZipFile]::ExtractToDirectory($zip, $script:extractedDir, $true)
+        }
+        if ($script:extractedDir)
+        {
+            foreach ($file in @(Get-ChildItem (Join-Path $script:extractedDir '*.pbit')))
+            {
+                $script:templatePath[$file.BaseName] = $file.FullName
+            }
+        }
+    }
+    $script:anyBuilt = $script:templatePath.Count -gt 0
+
+    $script:config = (Get-Content (Join-Path $script:powerBiDir 'reports.json') -Raw | ConvertFrom-Json -Depth 10).reports
+
+    <#
+        Reads a part of a PBIT as text. Power BI writes most parts as UTF-16LE, with or without a
+        byte order mark, and other parts (like theme files) as UTF-8, so the encoding is detected.
+    #>
+    function Get-PbitText([System.IO.Compression.ZipArchiveEntry] $Entry)
+    {
+        $stream = $Entry.Open()
+        try
+        {
+            $buffer = New-Object System.IO.MemoryStream
+            $stream.CopyTo($buffer)
+            $bytes = $buffer.ToArray()
+        }
+        finally { $stream.Dispose() }
+
+        if ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFF -and $bytes[1] -eq 0xFE) { return [System.Text.Encoding]::Unicode.GetString($bytes, 2, $bytes.Length - 2) }
+        if ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFE -and $bytes[1] -eq 0xFF) { return [System.Text.Encoding]::BigEndianUnicode.GetString($bytes, 2, $bytes.Length - 2) }
+        # UTF-16LE text that is mostly ASCII has a zero byte in every second position
+        if ($bytes.Length -ge 4 -and $bytes[1] -eq 0 -and $bytes[3] -eq 0) { return [System.Text.Encoding]::Unicode.GetString($bytes) }
+        return [System.Text.Encoding]::UTF8.GetString($bytes).TrimStart([char]0xFEFF)
+    }
+
+    # Why a template's tests can't run, or nothing when they can. Nothing built skips everything.
+    # A template that is missing or unreadable fails once, in "Is built", and skips the rest.
+    function Get-SkipReason
+    {
+        if (-not $script:anyBuilt) { return $script:notBuilt }
+        if (-not $script:model) { return "$Label.pbit is missing or unreadable (see the 'Is built' test)." }
+        return $null
+    }
+
+    # M and DAX are stored as a string or as an array of lines, depending on the writer
+    function Get-ExpressionText($Expression)
+    {
+        return (@($Expression) -join "`n")
+    }
+
+    function Test-PbitParameter($Expression)
+    {
+        return (Get-ExpressionText $Expression) -match 'IsParameterQuery\s*=\s*true'
+    }
+
+    function Get-SourceParameter([string] $Type)
+    {
+        $path = Join-Path $script:powerBiDir "$Type/Shared.Dataset/definition/expressions.tmdl"
+        $parameters = @{}
+        foreach ($line in [System.IO.File]::ReadAllLines($path))
+        {
+            if ($line -notmatch "^expression (?:'(?<quoted>(?:[^']|'')+)'|(?<plain>\S+)) = (?<value>.+) meta \[(?<meta>[^\]]*IsParameterQuery=true[^\]]*)\]\s*$") { continue }
+
+            $name = if ($Matches.quoted) { $Matches.quoted.Replace("''", "'") } else { $Matches.plain }
+            $parameters[$name] = @{ Value = $Matches.value; Meta = $Matches.meta }
+        }
+        return $parameters
+    }
+
+    # reports.json lists a table for both report types when only one of them has it (for example,
+    # Prices only exists in the storage model), so what a template gets is the overlap
+    function Get-SourceTable([string] $Type)
+    {
+        $names = foreach ($file in @(Get-ChildItem (Join-Path $script:powerBiDir "$Type/Shared.Dataset/definition/tables") -Filter '*.tmdl'))
+        {
+            foreach ($line in [System.IO.File]::ReadAllLines($file.FullName))
+            {
+                if ($line -match '^table\s+(?<rest>.+)$') { ConvertFrom-TmdlDeclaration $Matches.rest; break }
+            }
+        }
+        return @($names)
+    }
+
+    # Normalize spacing, which Power BI Desktop can change when it re-saves a model
+    function Format-Expression([string] $Text)
+    {
+        return ($Text -replace '\s+', ' ').Trim()
+    }
+
+    $script:sourceParameters = @{ kql = Get-SourceParameter 'kql'; storage = Get-SourceParameter 'storage' }
+    $script:sourceTables = @{ kql = Get-SourceTable 'kql'; storage = Get-SourceTable 'storage' }
+}
+
+AfterAll {
+    if ($script:extractedDir) { Remove-Item $script:extractedDir -Recurse -Force -ErrorAction SilentlyContinue }
+}
+
+Describe 'Power BI templates' {
+    It 'Has the expected source parameters to compare against' {
+        # Guards the tests below, which would otherwise pass with nothing to compare
+        $script:sourceParameters.kql.Keys | Should -Contain 'Cluster URL'
+        $script:sourceParameters.storage.Keys | Should -Contain 'Storage URL'
+    }
+
+    It 'Has 6 <_> templates' -ForEach 'kql', 'storage' {
+        if (-not $script:anyBuilt) { Set-ItResult -Skipped -Because $script:notBuilt; return }
+
+        # One template per report in reports.json, named <report>.<type>
+        $type = $_
+        $expected = @($script:config.PSObject.Properties.Name | ForEach-Object { "$_.$type" } | Sort-Object)
+        $built = @($script:templatePath.Keys | Where-Object { $_.EndsWith(".$type") } | Sort-Object)
+        $built | Should -Be $expected
+        $built.Count | Should -Be 6
+    }
+
+    It 'Has a PowerBI-<_>.zip with the same 6 templates' -ForEach 'kql', 'storage' {
+        $zip = Join-Path $script:releaseDir "PowerBI-$_.zip"
+        if (-not (Test-Path $zip)) { Set-ItResult -Skipped -Because "release/PowerBI-$_.zip is not built. $script:notBuilt"; return }
+
+        $type = $_
+        $archive = [System.IO.Compression.ZipFile]::OpenRead($zip)
+        try { $entries = @($archive.Entries | ForEach-Object { $_.FullName } | Where-Object { $_ -like '*.pbit' } | Sort-Object) }
+        finally { $archive.Dispose() }
+
+        $expected = @($script:config.PSObject.Properties.Name | ForEach-Object { "$_.$type.pbit" } | Sort-Object)
+        $entries | Should -Be $expected
+    }
+}
+
+Describe 'Power BI template <Label>' -ForEach $templates {
+    BeforeAll {
+        $script:model = $null
+        $script:allText = ''
+        $script:loadError = $null
+
+        $path = $script:templatePath[$Label]
+        if ($path)
+        {
+            try
+            {
+                $archive = [System.IO.Compression.ZipFile]::OpenRead($path)
+                try
+                {
+                    $parts = @($archive.Entries | Where-Object { $_.Length -gt 0 -and $_.FullName -notmatch '\.(png|svg|jpg|jpeg|gif)$' })
+                    $schemaEntry = $parts | Where-Object { $_.FullName -eq 'DataModelSchema' } | Select-Object -First 1
+                    if (-not $schemaEntry) { throw 'The template has no DataModelSchema part.' }
+
+                    # -AsHashtable because Power BI writes some properties with empty names
+                    $schemaText = Get-PbitText $schemaEntry
+                    $script:model = ($schemaText | ConvertFrom-Json -Depth 100 -AsHashtable).model
+
+                    # Everything a person could see, for the demo data checks
+                    $script:allText = (@($parts | ForEach-Object { if ($_.FullName -eq 'DataModelSchema') { $schemaText } else { Get-PbitText $_ } })) -join "`n"
+                }
+                finally { $archive.Dispose() }
+            }
+            catch { $script:loadError = $_.Exception.Message }
+        }
+
+        $settings = $script:config.$Name
+        $script:keptTables = Resolve-Allowlist @($settings.tables) $Type
+        $script:keptQueries = Resolve-Allowlist @($settings.queries) $Type
+        $script:tables = @{}
+        $script:expressions = @{}
+        if ($script:model)
+        {
+            foreach ($table in @($script:model.tables)) { $script:tables[$table.name] = $table }
+            foreach ($expression in @($script:model.expressions)) { $script:expressions[$expression.name] = Get-ExpressionText $expression.expression }
+        }
+        $script:parameters = @($script:expressions.Keys | Where-Object { Test-PbitParameter $script:expressions[$_] })
+    }
+
+    It 'Is built' {
+        if (-not $script:anyBuilt) { Set-ItResult -Skipped -Because $script:notBuilt; return }
+
+        $script:templatePath[$Label] | Should -Not -BeNullOrEmpty -Because "$Label.pbit should be built. Run ./src/scripts/Build-PowerBI.ps1 -NoPbip"
+        $script:loadError | Should -BeNullOrEmpty
+        $script:model | Should -Not -BeNullOrEmpty
+    }
+
+    It 'Has the tables reports.json keeps' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        # Parameters and functions that do not load a table are listed under queries, not tables
+        $expected = @($script:keptTables | Where-Object { $script:sourceTables[$Type] -contains $_ } | Sort-Object -Unique)
+        $expected | Should -Not -BeNullOrEmpty -Because "reports.json lists tables for $Name"
+        @($script:tables.Keys | Sort-Object) | Should -Be $expected
+    }
+
+    It 'Prompts for the parameters the shared dataset defines for the report' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        $source = $script:sourceParameters[$Type]
+        $expected = @($source.Keys | Where-Object { $script:keptQueries -contains $_ } | Sort-Object)
+        @($script:parameters | Sort-Object) | Should -Be $expected
+    }
+
+    It 'Prompts for the required parameters' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        # Names only: values come from the shared dataset in the next test
+        $required = if ($Type -eq 'storage')
+        {
+            'Storage URL', 'RangeStart', 'RangeEnd', 'Number of Months', 'Default Granularity', 'Experimental: Add Missing Prices', 'Deprecated: Perform Extra Query Optimizations'
+        }
+        else
+        {
+            'Cluster URL', 'Number of Months', 'Default Granularity'
+        }
+        foreach ($name in $required) { $script:parameters | Should -Contain $name }
+    }
+
+    It 'Asks for Remove Duplicate Resource IDs only when reports.json keeps it' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        $kept = $script:keptQueries -contains 'Remove Duplicate Resource IDs'
+        ($script:parameters -contains 'Remove Duplicate Resource IDs') | Should -Be $kept
+    }
+
+    It 'Has the same default for each parameter as the shared dataset, with data sources emptied' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        $source = $script:sourceParameters[$Type]
+        $wrong = foreach ($name in $script:parameters)
+        {
+            if (-not $source.ContainsKey($name)) { continue }
+
+            # Data source URLs ship empty so people supply their own. Everything else is unchanged.
+            $value = if ($name.EndsWith(' URL')) { 'null' } else { $source[$name].Value }
+            $expected = Format-Expression "$value meta [$($source[$name].Meta)]"
+            $actual = Format-Expression $script:expressions[$name]
+            if ($actual -ne $expected) { "'$name' is '$actual', expected '$expected'" }
+        }
+        $wrong | Should -BeNullOrEmpty
+    }
+
+    It 'Has empty data source parameters' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        $empty = @($script:parameters | Where-Object { $_.EndsWith(' URL') -or $_ -in 'RangeStart', 'RangeEnd' })
+        $empty | Should -Not -BeNullOrEmpty -Because 'every template has a Storage URL or Cluster URL parameter'
+        $notEmpty = $empty | Where-Object { $script:expressions[$_] -notmatch '^\s*null\s+meta\s*\[' } | ForEach-Object { "'$_' is $($script:expressions[$_])" }
+        $notEmpty | Should -BeNullOrEmpty
+
+        # The demo filter limits demo reports to the demo hub. Templates ship it empty.
+        if ($script:expressions.ContainsKey('ftk_DemoFilter'))
+        {
+            $script:expressions['ftk_DemoFilter'] | Should -Match '^\s*\(\)\s*=>\s*""'
+        }
+    }
+
+    It 'Has no hard-coded storage account or cluster' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        # A name in front of the endpoint is an account. Help text only mentions the bare endpoint.
+        $pattern = '(?i)[a-z0-9][a-z0-9-]*\.(?:dfs|blob)\.core\.windows\.net|[a-z0-9][a-z0-9-]*\.[a-z0-9]+\.kusto\.windows\.net'
+        $found = [regex]::Matches($script:allText, $pattern) | ForEach-Object { $_.Value } | Sort-Object -Unique
+        $found | Should -BeNullOrEmpty -Because 'templates ship without a data source'
+    }
+
+    It 'Has no demo hub or demo storage account' {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        $found = [regex]::Matches($script:allText, '(?i)ftk-?demo[a-z0-9-]*') | ForEach-Object { $_.Value } | Sort-Object -Unique
+        $found | Should -BeNullOrEmpty -Because 'demo data sources belong in the demo reports, not the templates'
+    }
+
+    It 'Reads gzip-compressed exports' -Skip:($Type -ne 'storage') {
+        if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
+
+        # Costs reads exports through ftk_Storage, so the .gz handling lives there. Booleans, not
+        # Should -Match, because these queries are long and a failure would print all of one.
+        $costs = Get-ExpressionText $script:tables['Costs'].partitions[0].source.expression
+        ($costs -match 'ftk_Storage\s*\(\s*"focuscost"') | Should -BeTrue -Because 'the Costs query should read focuscost exports through ftk_Storage'
+
+        $storage = $script:expressions['ftk_Storage']
+        $storage | Should -Not -BeNullOrEmpty -Because 'the Costs query depends on ftk_Storage'
+        $storage.Contains('[Extension] = ".gz"') | Should -BeTrue -Because 'ftk_Storage should include .gz files, like [Extension] = ".gz"'
+        ($storage -match 'Binary\.Decompress\(\[Content\], Compression\.GZip\)') | Should -BeTrue -Because 'ftk_Storage should decompress .gz files'
+    }
+}
diff --git a/src/scripts/Package-PowerBI.ps1 b/src/scripts/Package-PowerBI.ps1
index 76c1749bc..a87b3fb83 100644
--- a/src/scripts/Package-PowerBI.ps1
+++ b/src/scripts/Package-PowerBI.ps1
@@ -28,6 +28,9 @@
     .PARAMETER Status
     Optional. Reports what's done and what's left without changing anything. Default = false.
 
+    .PARAMETER ValidateTemplates
+    Optional. Opens each PBIT template in Power BI Desktop with Test-PowerBITemplates before packaging, so a template that shows an error or the wrong parameter prompt fails here instead of shipping. Windows only. Default = false.
+
     .PARAMETER SensitivityLabel
     Optional. Sensitivity label demo reports must have, when the tenant has labels. Reports saved without any label pass. Default = "Public".
 
@@ -69,6 +72,8 @@ param(
 
     [switch] $Status,
 
+    [switch] $ValidateTemplates,
+
     [string] $SensitivityLabel = 'Public',
 
     [string] $OpenDataUrl,
@@ -569,6 +574,18 @@ if ($failed -gt 0)
     throw "$failed demo report$(if ($failed -ne 1) { 's' }) failed validation. Fix the issues above, save again (or run ./Package-PowerBI -Unattended), and rerun this command."
 }
 
+if ($ValidateTemplates)
+{
+    if ($null -ne $IsWindows -and -not $IsWindows)
+    {
+        throw 'Validating templates needs Power BI Desktop, which only runs on Windows. Run this command on Windows, or leave out -ValidateTemplates.'
+    }
+
+    Write-Host ''
+    Write-Host 'Opening the templates in Power BI Desktop...'
+    $null = & "$PSScriptRoot/Test-PowerBITemplates.ps1" -Path $pbitDir
+}
+
 Write-Host ''
 if ($demoZipCurrent)
 {
diff --git a/src/scripts/README.md b/src/scripts/README.md
index 4cda88315..e1d694d79 100644
--- a/src/scripts/README.md
+++ b/src/scripts/README.md
@@ -18,6 +18,7 @@ On this page:
 - [📊 Build-PowerBI](#-build-powerbi)
 - [📊 Package-PowerBI](#-package-powerbi)
 - [📊 Save-PowerBIProject](#-save-powerbiproject)
+- [📊 Test-PowerBITemplates](#-test-powerbitemplates)
 - [📦 Package-Toolkit](#-package-toolkit)
 - [©️ Add-CopyrightHeader](#️-add-copyrightheader)
 - [📁 New-Directory](#-new-directory)
@@ -576,6 +577,7 @@ Saved PBIX files are checked for the mistakes that are easy to make by hand —
 | `‑Open`             | Optional. Opens the projects that still need to be saved as PBIX files. Default = false.                                           |
 | `‑Build`            | Optional. Rebuilds the templates and projects even if they already exist. Default = false.                                         |
 | `‑Status`           | Optional. Reports what's done and what's left without changing anything. Exits with 1 while anything is pending. Default = false.                  |
+| `‑ValidateTemplates` | Optional. Opens each template in Power BI Desktop with [Test-PowerBITemplates](#-test-powerbitemplates) before packaging. Windows only. Default = false. |
 | `‑SensitivityLabel` | Optional. Sensitivity label demo reports must have, if they have one. Default = "Public".                                          |
 | `‑OpenDataUrl`      | Optional. Base URL demo reports read open data from when they are rebuilt. Default = the `main` branch. |
 | `‑TestOpenDataUrl`  | Optional. Allows `‑OpenDataUrl` to point at a branch. Reports built that way are not packaged. Default = false. |
@@ -635,6 +637,44 @@ Example:
 
 <br>
 
+## 📊 Test-PowerBITemplates
+
+[Test-PowerBITemplates.ps1](./Test-PowerBITemplates.ps1) opens each PBIT template in Power BI Desktop and checks what a person sees: no error dialog, and a parameter prompt titled after the template that lists the expected parameters, with the Storage URL, Cluster URL, RangeStart, and RangeEnd fields empty. KQL templates show a "Potential security risk" dialog first, which the script answers with OK. It saves a screenshot of each prompt to `release/pbit-test` and ends only the Power BI Desktop processes it started. Run it after [Build-PowerBI](#-build-powerbi), or add `‑ValidateTemplates` to [Package-PowerBI](#-package-powerbi).
+
+Power BI Desktop shows these dialogs in an embedded browser control that Windows UI Automation can't see into, so the script finds them from the process's window list and reads the prompt through the control's page, the way screen readers do. Nothing is typed and the mouse isn't used, but dialogs open and take focus while it runs, so expect about 30 seconds per template and avoid working in Power BI Desktop meanwhile.
+
+It doesn't check anything past the prompt. Power BI Desktop doesn't expose report page tabs to automation, and loading the report needs a data source. To check the contents of the templates without Power BI Desktop (on any platform), run the `PowerBITemplates` unit tests with [Test-PowerShell](#-test-powershell).
+
+Requirements:
+
+- Windows with Power BI Desktop installed and associated with `.pbit` files.
+- Built templates. Run `./Build-PowerBI -NoPbip` first.
+
+| Parameter          | Description                                                                                                            |
+| ------------------ | ---------------------------------------------------------------------------------------------------------------------- |
+| `‑Name`            | Optional. Name of the report to check. Wildcards supported. Default = \* (all).                                        |
+| `‑Path`            | Optional. Folder with the PBIT files, or the path to one PBIT file. Default = release/pbit.                            |
+| `‑KQL`             | Optional. Checks the KQL templates. Default = false (checks all if no types are selected).                             |
+| `‑Storage`         | Optional. Checks the storage templates. Default = false (checks all if no types are selected).                         |
+| `‑TimeoutSeconds`  | Optional. Maximum number of seconds to wait for the parameter prompt for each template. Default = 180.                 |
+| `‑ScreenshotPath`  | Optional. Folder to save one screenshot per template to. Default = release/pbit-test.                                  |
+
+Examples:
+
+- Check the Cost summary storage template.
+
+  ```powershell
+  ./Test-PowerBITemplates CostSummary -Storage
+  ```
+
+- Check all 12 templates.
+
+  ```powershell
+  ./Test-PowerBITemplates
+  ```
+
+<br>
+
 ## 📦 Package-Toolkit
 
 [Package-Toolkit.ps1](./Package-Toolkit.ps1) packages all toolkit templates as ZIP files for release.
diff --git a/src/scripts/Test-PowerBITemplates.ps1 b/src/scripts/Test-PowerBITemplates.ps1
new file mode 100644
index 000000000..835a7386d
--- /dev/null
+++ b/src/scripts/Test-PowerBITemplates.ps1
@@ -0,0 +1,570 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    .SYNOPSIS
+    Opens each Power BI template (PBIT) in Power BI Desktop and checks what a person sees.
+
+    .DESCRIPTION
+    Replaces the manual check of opening every template in Power BI Desktop, confirming there is
+    no error, and reading the parameter prompt. For each template, this:
+
+    1. Opens the PBIT in Power BI Desktop.
+    2. Answers the "Potential security risk" dialog with OK, when it appears (KQL templates).
+    3. Waits for the parameter prompt, whose title is the template name.
+    4. Fails when any other dialog or error window shows up first.
+    5. Reads the prompt and checks its title, parameter names, and values against what the PBIT
+       defines. A template that ships with a data source filled in (like a demo hub) fails here.
+    6. Saves a screenshot, then ends the Power BI Desktop process this script started.
+
+    The prompt is read through its web page, not through Windows UI Automation. Power BI Desktop
+    shows its dialogs in an embedded browser control, and UI Automation doesn't list those windows
+    or what's in them: it only sees the main window. The dialogs are found by listing the
+    process's windows (the title is the dialog title), and the page is read through the browser
+    control's document (the same way screen readers do). Nothing is typed or clicked with the
+    mouse: buttons are pressed through the page, so the mouse and keyboard stay free, but dialogs
+    do open and take focus while this runs.
+
+    What this can't check: the report pages. Power BI Desktop doesn't expose report page tabs
+    to any automation, and loading the report needs a data source, so nothing past the prompt is
+    opened. Run Test-PowerShell to check what is inside each template without Power BI Desktop
+    (src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1).
+
+    Only Power BI Desktop processes this script starts are ended. Instances you already had open
+    are left alone.
+
+    Windows only. Requires Power BI Desktop, associated with .pbit files.
+
+    .PARAMETER Path
+    Optional. Folder with the PBIT files, or the path to one PBIT file. Default = release/pbit.
+
+    .PARAMETER Name
+    Optional. Name of the report to check, like CostSummary. Wildcards supported. Default = * (all).
+
+    .PARAMETER KQL
+    Optional. Checks the KQL templates. Default = false (checks all if no types are selected).
+
+    .PARAMETER Storage
+    Optional. Checks the storage templates. Default = false (checks all if no types are selected).
+
+    .PARAMETER TimeoutSeconds
+    Optional. Maximum number of seconds to wait for the parameter prompt for each template. Default = 180.
+
+    .PARAMETER ScreenshotPath
+    Optional. Folder to save one screenshot per template to. Default = release/pbit-test.
+
+    .EXAMPLE
+    ./Test-PowerBITemplates CostSummary -Storage
+
+    Checks the Cost summary storage template.
+
+    .EXAMPLE
+    ./Test-PowerBITemplates
+
+    Checks all 12 templates. This takes about 30 seconds each.
+
+    .LINK
+    https://github.com/microsoft/finops-toolkit/blob/dev/src/scripts/README.md#-test-powerbitemplates
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Position = 0)]
+    [string]
+    $Name = '*',
+
+    [string]
+    $Path,
+
+    [switch]
+    $KQL,
+
+    [switch]
+    $Storage,
+
+    [int]
+    $TimeoutSeconds = 180,
+
+    [string]
+    $ScreenshotPath
+)
+
+$ErrorActionPreference = 'Stop'
+
+if ($null -ne $IsWindows -and -not $IsWindows)
+{
+    throw 'Power BI Desktop only runs on Windows. Run the template tests in src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1 to check the templates on other platforms.'
+}
+
+$relDir = Join-Path $PSScriptRoot '../../release'
+if (-not $Path) { $Path = Join-Path $relDir 'pbit' }
+if (-not $ScreenshotPath) { $ScreenshotPath = Join-Path $relDir 'pbit-test' }
+$ScreenshotPath = [System.IO.Path]::GetFullPath($ScreenshotPath, $PWD.Path)
+if (-not $KQL -and -not $Storage) { $KQL = $Storage = $true }
+
+$templates = @(
+    if (Test-Path $Path -PathType Leaf) { Get-Item $Path }
+    elseif (Test-Path $Path -PathType Container) { Get-ChildItem $Path -Filter '*.pbit' }
+) | Where-Object {
+    $report, $type = $_.BaseName -split '\.'
+    $report -like $Name -and (($type -eq 'kql' -and $KQL) -or ($type -eq 'storage' -and $Storage))
+} | Sort-Object Name
+
+if ($templates.Count -eq 0)
+{
+    throw "No templates found in '$Path'$(if ($Name -ne '*') { " matching '$Name'" }). Build them with ./Build-PowerBI -NoPbip."
+}
+
+Add-Type -AssemblyName System.Windows.Forms, System.Drawing, System.IO.Compression.FileSystem
+
+# A type can't be redefined once it's loaded, so it's compiled under a name nothing has used yet. That
+# way a session never has to be restarted to pick up changes here.
+$script:Win32Name = "Win32_$([guid]::NewGuid().ToString('N'))"
+Add-Type -Namespace FinOpsToolkit -Name $script:Win32Name -MemberDefinition @'
+private delegate bool EnumTopProc(IntPtr hWnd, IntPtr lParam);
+[DllImport("user32.dll")] private static extern bool EnumWindows(EnumTopProc callback, IntPtr lParam);
+[DllImport("user32.dll")] private static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);
+[DllImport("user32.dll")] private static extern bool IsWindowVisible(IntPtr hWnd);
+// The callbacks have to be compiled code. A PowerShell scriptblock passed as the delegate never gets
+// called, so enumerations live here and hand back plain arrays.
+public static IntPtr[] GetTopLevelWindows(int processId)
+{
+    var found = new System.Collections.Generic.List<IntPtr>();
+    EnumWindows((h, l) => { uint owner; GetWindowThreadProcessId(h, out owner); if (owner == (uint)processId && IsWindowVisible(h)) { found.Add(h); } return true; }, IntPtr.Zero);
+    return found.ToArray();
+}
+private delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
+[DllImport("user32.dll")] private static extern bool EnumChildWindows(IntPtr parent, EnumProc callback, IntPtr lParam);
+public static IntPtr[] GetDescendants(IntPtr parent)
+{
+    var found = new System.Collections.Generic.List<IntPtr>();
+    EnumChildWindows(parent, (h, l) => { found.Add(h); return true; }, IntPtr.Zero);
+    return found.ToArray();
+}
+[DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder name, int count);
+[DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder name, int count);
+[DllImport("user32.dll", CharSet = CharSet.Unicode)] private static extern uint RegisterWindowMessage(string msg);
+[DllImport("user32.dll", CharSet = CharSet.Auto)] private static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam, uint flags, uint timeout, out IntPtr result);
+[DllImport("oleacc.dll")] private static extern int ObjectFromLresult(IntPtr lResult, ref Guid riid, IntPtr wParam, [MarshalAs(UnmanagedType.IUnknown)] out object ppvObject);
+// Asks an embedded browser control (class "Internet Explorer_Server") for its HTML document, which is
+// how accessibility tools read it. Returns null when the page isn't ready.
+public static object GetHtmlDocument(IntPtr hwnd)
+{
+    uint message = RegisterWindowMessage("WM_HTML_GETOBJECT");
+    IntPtr result;
+    SendMessageTimeout(hwnd, message, IntPtr.Zero, IntPtr.Zero, 2, 5000, out result); // SMTO_ABORTIFHUNG
+    if (result == IntPtr.Zero) { return null; }
+    Guid iid = new Guid("626FC520-A41E-11cf-A731-00A0C9082637"); // IHTMLDocument2
+    object document;
+    return ObjectFromLresult(result, ref iid, IntPtr.Zero, out document) == 0 ? document : null;
+}
+'@
+$win32 = "FinOpsToolkit.$script:Win32Name" -as [type]
+
+#region Helpers
+
+function Write-Step([string] $Message)
+{
+    Write-Host "    $Message"
+}
+
+function Get-WindowClass([IntPtr] $Handle)
+{
+    $text = New-Object System.Text.StringBuilder 256
+    $null = $win32::GetClassName($Handle, $text, $text.Capacity)
+    return $text.ToString()
+}
+
+function Get-WindowTitle([IntPtr] $Handle)
+{
+    $text = New-Object System.Text.StringBuilder 512
+    $null = $win32::GetWindowText($Handle, $text, $text.Capacity)
+    return $text.ToString()
+}
+
+<#
+    .SYNOPSIS
+    Lists the visible windows of a process other than its main window, with what they host.
+
+    .DESCRIPTION
+    Dialogs are either web pages in an embedded browser control (the security warning, the parameter
+    prompt, and Power BI Desktop's own errors) or ordinary Windows dialogs. UI Automation lists
+    neither kind, so they're found from Windows' own list of the process's windows.
+#>
+function Get-DesktopDialog([int] $ProcessId)
+{
+    $dialogs = foreach ($handle in @($win32::GetTopLevelWindows($ProcessId)))
+    {
+        $title = Get-WindowTitle $handle
+
+        # The main window is titled after the open file, like "Untitled - Power BI Desktop"
+        if ($title -match 'Power BI Desktop$') { continue }
+
+        $browser = @($win32::GetDescendants($handle) | Where-Object { (Get-WindowClass $_) -eq 'Internet Explorer_Server' }) | Select-Object -First 1
+        [PSCustomObject]@{ Handle = $handle; Title = $title; Browser = $browser }
+    }
+    return , @($dialogs | Where-Object { $_ })
+}
+
+function Get-HtmlText($Element)
+{
+    return ("$($Element.innerText)" -replace '\s+', ' ').Trim()
+}
+
+<#
+    .SYNOPSIS
+    Reads a dialog's page. Returns null while the page isn't ready.
+#>
+function Read-DialogPage($Dialog)
+{
+    if (-not $Dialog.Browser) { return $null }
+
+    try
+    {
+        $document = $win32::GetHtmlDocument($Dialog.Browser)
+        if (-not $document) { return $null }
+
+        $elements = @($document.getElementsByTagName('div'))
+        $title = $elements | Where-Object { $_.id -eq 'dialogTitle' } | Select-Object -First 1
+        $body = @($document.getElementsByTagName('body')) | Select-Object -First 1
+        $parameters = foreach ($field in @($elements | Where-Object { $_.className -eq 'o-group-fieldTemplate' }))
+        {
+            $label = @($field.getElementsByTagName('*') | Where-Object { $_.className -eq 'o-content-label' }) | Select-Object -First 1
+            $box = @($field.getElementsByTagName('input')) | Select-Object -First 1
+            if ($label) { [PSCustomObject]@{ Name = Get-HtmlText $label; Value = if ($box) { "$($box.value)" } else { $null } } }
+        }
+
+        return [PSCustomObject]@{
+            Document   = $document
+            Title      = if ($title) { Get-HtmlText $title } else { $null }
+            Text       = if ($body) { Get-HtmlText $body } else { '' }
+            Parameters = @($parameters | Where-Object { $_ })
+        }
+    }
+    catch
+    {
+        # The page can change under us while it loads, so try again on the next pass
+        Write-Verbose "Could not read the dialog page: $($_.Exception.Message)"
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+    Presses a button in a dialog's page, without the mouse.
+#>
+function Invoke-DialogButton($Page, [string] $Text)
+{
+    $button = @($Page.Document.getElementsByTagName('div')) `
+    | Where-Object { $_.className -match '\bo-action-button\b' -and (Get-HtmlText $_) -eq $Text } `
+    | Select-Object -First 1
+    if (-not $button) { return $false }
+
+    $button.click()
+    return $true
+}
+
+function Save-Screenshot([string] $File)
+{
+    try
+    {
+        $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
+        $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height)
+        $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
+        $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size)
+        $bitmap.Save($File, [System.Drawing.Imaging.ImageFormat]::Png)
+        $graphics.Dispose()
+        $bitmap.Dispose()
+        return $File
+    }
+    catch
+    {
+        Write-Verbose "Could not save a screenshot: $($_.Exception.Message)"
+        return $null
+    }
+}
+
+<#
+    .SYNOPSIS
+    Ends a Power BI Desktop process this script started, and the processes it started.
+#>
+function Stop-Desktop([System.Diagnostics.Process] $Process)
+{
+    if (-not $Process -or $Process.HasExited) { return }
+
+    Get-CimInstance Win32_Process -Filter "ParentProcessId = $($Process.Id)" -ErrorAction SilentlyContinue `
+    | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+    Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue
+    try { [void]$Process.WaitForExit(10000) } catch { Write-Verbose "Could not wait for Power BI Desktop to exit: $($_.Exception.Message)" }
+}
+
+<#
+    .SYNOPSIS
+    Reads a part of a PBIT as text. Power BI writes most parts as UTF-16LE, with or without a byte order mark.
+#>
+function Read-PbitText([string] $File, [string] $Part)
+{
+    $archive = [System.IO.Compression.ZipFile]::OpenRead($File)
+    try
+    {
+        $entry = $archive.GetEntry($Part)
+        if (-not $entry) { throw "$File has no $Part part." }
+
+        $stream = $entry.Open()
+        try
+        {
+            $buffer = New-Object System.IO.MemoryStream
+            $stream.CopyTo($buffer)
+            $bytes = $buffer.ToArray()
+        }
+        finally { $stream.Dispose() }
+    }
+    finally { $archive.Dispose() }
+
+    if ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFF -and $bytes[1] -eq 0xFE) { return [System.Text.Encoding]::Unicode.GetString($bytes, 2, $bytes.Length - 2) }
+    if ($bytes.Length -ge 4 -and $bytes[1] -eq 0 -and $bytes[3] -eq 0) { return [System.Text.Encoding]::Unicode.GetString($bytes) }
+    return [System.Text.Encoding]::UTF8.GetString($bytes).TrimStart([char]0xFEFF)
+}
+
+<#
+    .SYNOPSIS
+    Works out what the parameter prompt should show for a template, from the parameters in its data model.
+
+    .DESCRIPTION
+    The prompt lists the parameters in query order and starts each one at its default value when the
+    parameter declares one, and at its current value otherwise. Text shows without quotes, true and
+    false show as TRUE and FALSE, and an empty (null) parameter shows nothing.
+#>
+function Get-ExpectedPrompt([string] $File)
+{
+    $model = (Read-PbitText $File 'DataModelSchema' | ConvertFrom-Json -Depth 100 -AsHashtable).model
+
+    $order = @()
+    $orderAnnotation = @($model.annotations | Where-Object { $_.name -eq 'PBI_QueryOrder' }) | Select-Object -First 1
+    if ($orderAnnotation) { $order = @($orderAnnotation.value | ConvertFrom-Json) }
+
+    $parameters = New-Object System.Collections.Generic.List[object]
+    foreach ($expression in @($model.expressions))
+    {
+        $text = @($expression.expression) -join "`n"
+        if ($text -notmatch '(?s)^\s*(?<value>.+?)\s+meta\s*\[(?<meta>[^\]]*IsParameterQuery\s*=\s*true[^\]]*)\]\s*$') { continue }
+
+        $value = $Matches.value
+        if ($Matches.meta -match 'DefaultValue\s*=\s*(?<default>"[^"]*"|[^,\]\s]+)') { $value = $Matches.default }
+
+        $shown = switch -Regex ($value)
+        {
+            '^null$' { '' }
+            '^"(?<text>.*)"$' { $Matches.text }
+            '^(true|false)$' { $value.ToUpperInvariant() }
+            default { $value }
+        }
+        $index = [array]::IndexOf($order, $expression.name)
+        $parameters.Add([PSCustomObject]@{ Name = $expression.name; Value = $shown; Order = if ($index -ge 0) { $index } else { [int]::MaxValue } })
+    }
+
+    return @($parameters | Sort-Object Order)
+}
+
+#endregion Helpers
+
+#region Test
+
+<#
+    .SYNOPSIS
+    Opens one template in Power BI Desktop and returns what was found.
+#>
+function Test-Template([System.IO.FileInfo] $Template)
+{
+    $label = $Template.BaseName
+    $failures = New-Object System.Collections.Generic.List[string]
+    $result = [PSCustomObject]@{
+        Template       = $label
+        Passed         = $false
+        SecurityDialog = $false
+        Parameters     = @()
+        Screenshot     = $null
+        Seconds        = 0
+        Failures       = $failures
+    }
+    $started = Get-Date
+    $desktop = $null
+
+    try
+    {
+        $expected = Get-ExpectedPrompt $Template.FullName
+
+        $existing = @(Get-Process PBIDesktop -ErrorAction SilentlyContinue | ForEach-Object { $_.Id })
+        Start-Process -FilePath $Template.FullName
+
+        # Power BI Desktop is found by being new, so only a process this script started is ever ended
+        $limit = (Get-Date).AddSeconds(120)
+        while (-not $desktop -and (Get-Date) -lt $limit)
+        {
+            $desktop = Get-Process PBIDesktop -ErrorAction SilentlyContinue | Where-Object { $existing -notcontains $_.Id } | Select-Object -First 1
+            if (-not $desktop) { Start-Sleep -Milliseconds 500 }
+        }
+        if (-not $desktop)
+        {
+            $failures.Add('Power BI Desktop did not start. Check that it is installed and opens .pbit files.')
+            return $result
+        }
+
+        $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
+        $pressed = @{}
+        $unexpected = New-Object System.Collections.Generic.List[string]
+        $prompt = $null
+
+        while ((Get-Date) -lt $deadline -and -not $prompt)
+        {
+            if ($desktop.HasExited)
+            {
+                $failures.Add("Power BI Desktop exited before showing the parameter prompt (exit code $($desktop.ExitCode)).")
+                break
+            }
+
+            foreach ($dialog in (Get-DesktopDialog $desktop.Id))
+            {
+                $page = Read-DialogPage $dialog
+                $title = if ($dialog.Title) { $dialog.Title } elseif ($page) { $page.Title } else { $null }
+
+                if ($title -eq 'Potential security risk')
+                {
+                    # Templates that read from more than one source warn before the prompt. Answer it once it has
+                    # loaded, and again if it is still there a few seconds later.
+                    $result.SecurityDialog = $true
+                    $last = $pressed[[string]$dialog.Handle]
+                    if ($page -and (-not $last -or ((Get-Date) - $last).TotalSeconds -ge 5))
+                    {
+                        if (Invoke-DialogButton $page 'OK') { Write-Step 'Answered the "Potential security risk" dialog with OK.' }
+                        $pressed[[string]$dialog.Handle] = Get-Date
+                    }
+                }
+                elseif ($title -eq $label)
+                {
+                    # The prompt appears before its fields are drawn
+                    if ($page -and $page.Parameters.Count -gt 0) { $prompt = $page }
+                }
+                elseif ($title -or ($page -and $page.Text -match '(?i)\b(error|failed|couldn.t|could not|unable)\b'))
+                {
+                    $text = if ($page) { $page.Text } else { '' }
+                    $summary = "'$title' dialog$(if ($text) { ": $($text.Substring(0, [Math]::Min(300, $text.Length)))" })"
+                    if (-not $unexpected.Contains($summary)) { $unexpected.Add($summary) }
+                }
+            }
+
+            # An error ends the wait early. The prompt never follows one.
+            if ($unexpected.Count -gt 0 -and $deadline -gt (Get-Date).AddSeconds(10)) { $deadline = (Get-Date).AddSeconds(10) }
+            if (-not $prompt) { Start-Sleep -Milliseconds 500 }
+        }
+
+        if ($prompt)
+        {
+            # Give an error that follows the prompt a moment to show, then read what's there
+            Start-Sleep -Seconds 3
+            $dialogs = Get-DesktopDialog $desktop.Id
+            foreach ($dialog in $dialogs)
+            {
+                $page = Read-DialogPage $dialog
+                $title = if ($dialog.Title) { $dialog.Title } elseif ($page) { $page.Title } else { $null }
+                if ($title -and $title -ne $label -and $title -ne 'Potential security risk')
+                {
+                    $unexpected.Add("'$title' dialog$(if ($page) { ": $($page.Text.Substring(0, [Math]::Min(300, $page.Text.Length)))" })")
+                }
+                if ($title -eq $label) { $prompt = $page }
+            }
+
+            $result.Screenshot = Save-Screenshot (Join-Path $ScreenshotPath "$label.png")
+            $result.Parameters = $prompt.Parameters
+        }
+
+        foreach ($summary in $unexpected) { $failures.Add("Power BI Desktop showed a $summary") }
+
+        if (-not $prompt)
+        {
+            $result.Screenshot = Save-Screenshot (Join-Path $ScreenshotPath "$label.png")
+            if ($unexpected.Count -eq 0) { $failures.Add("The parameter prompt did not appear within $TimeoutSeconds seconds.") }
+            return $result
+        }
+
+        # The dialog is titled after the template
+        if ($prompt.Title -ne $label) { $failures.Add("The prompt is titled '$($prompt.Title)', not '$label'.") }
+
+        # Templates ship without a data source: the fields people fill in start empty, whatever the model says
+        foreach ($parameter in $prompt.Parameters | Where-Object { $_.Name.EndsWith(' URL') -or $_.Name -in 'RangeStart', 'RangeEnd' })
+        {
+            if ($parameter.Value) { $failures.Add("'$($parameter.Name)' starts as '$($parameter.Value)'. Templates ship without a data source, so it should be empty.") }
+        }
+        if ((@($prompt.Parameters | ForEach-Object { $_.Value }) + $prompt.Text) -match '(?i)ftk-?demo') { $failures.Add('The prompt mentions a demo hub or demo storage account (ftk-demo).') }
+
+        # Parameter names and values, in order
+        $actualNames = @($prompt.Parameters | ForEach-Object { $_.Name })
+        $expectedNames = @($expected | ForEach-Object { $_.Name })
+        $missing = @($expectedNames | Where-Object { $actualNames -notcontains $_ })
+        $extra = @($actualNames | Where-Object { $expectedNames -notcontains $_ })
+        if ($missing) { $failures.Add("The prompt is missing: $($missing -join ', ').") }
+        if ($extra) { $failures.Add("The prompt has unexpected parameters: $($extra -join ', ').") }
+        if (-not $missing -and -not $extra -and (($actualNames -join "`n") -ne ($expectedNames -join "`n")))
+        {
+            $failures.Add("The prompt lists parameters as '$($actualNames -join "', '")', expected '$($expectedNames -join "', '")'.")
+        }
+        foreach ($parameter in $prompt.Parameters)
+        {
+            $want = $expected | Where-Object { $_.Name -eq $parameter.Name } | Select-Object -First 1
+            if ($want -and $parameter.Value -ne $want.Value)
+            {
+                $failures.Add("'$($parameter.Name)' shows '$($parameter.Value)', expected '$($want.Value)'.")
+            }
+        }
+    }
+    catch
+    {
+        $failures.Add("Unexpected error: $($_.Exception.Message)")
+        if (-not $result.Screenshot) { $result.Screenshot = Save-Screenshot (Join-Path $ScreenshotPath "$label.png") }
+    }
+    finally
+    {
+        Stop-Desktop $desktop
+        $result.Seconds = [int]((Get-Date) - $started).TotalSeconds
+        $result.Passed = $failures.Count -eq 0
+    }
+
+    return $result
+}
+
+#endregion Test
+
+$null = New-Item $ScreenshotPath -ItemType Directory -Force
+
+Write-Host "Opening $($templates.Count) template$(if ($templates.Count -ne 1) { 's' }) in Power BI Desktop. Windows open and take focus while this runs, but the mouse and keyboard aren't used."
+if (@(Get-Process PBIDesktop -ErrorAction SilentlyContinue).Count -gt 0)
+{
+    Write-Host '    Power BI Desktop is already running. Those windows are left open.' -ForegroundColor Yellow
+}
+Write-Host ''
+
+$results = foreach ($template in $templates)
+{
+    Write-Host "  $($template.BaseName)..."
+    $result = Test-Template $template
+    if ($result.Passed)
+    {
+        Write-Host "  ✅ $($template.BaseName)  $($result.Parameters.Count) parameters, $($result.Seconds) s$(if ($result.SecurityDialog) { ', security dialog answered' })" -ForegroundColor Green
+    }
+    else
+    {
+        Write-Host "  ❌ $($template.BaseName)" -ForegroundColor Red
+        $result.Failures | ForEach-Object { Write-Host "       $_" -ForegroundColor Red }
+        if ($result.Screenshot) { Write-Host "       Screenshot: $($result.Screenshot)" -ForegroundColor Red }
+    }
+    $result
+}
+
+Write-Host ''
+$failed = @($results | Where-Object { -not $_.Passed })
+if ($failed.Count -gt 0)
+{
+    throw "$($failed.Count) of $(@($results).Count) templates failed in Power BI Desktop: $(($failed | ForEach-Object { $_.Template }) -join ', ')."
+}
+
+Write-Host "✅ $(@($results).Count) template$(if (@($results).Count -ne 1) { 's' }) opened in Power BI Desktop with the expected parameter prompt" -ForegroundColor Green
+return $results

From a67644832dfe2a13be439febb8f0b4f63b931a07 Mon Sep 17 00:00:00 2001
From: Michael Flanakin <flanakin@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:03:58 -0700
Subject: [PATCH 2/2] Validate templates before saving PBIX, guard dialog read,
 accept Fabric eventhouse URIs

Co-Authored-By: RolandKrummenacher <RolandKrummenacher@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../Tests/Unit/PowerBITemplates.Tests.ps1     |  7 ++---
 src/scripts/Package-PowerBI.ps1               | 29 +++++++++++--------
 src/scripts/Test-PowerBITemplates.ps1         |  2 +-
 3 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1 b/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
index 80538de02..4997d3b20 100644
--- a/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
+++ b/src/powershell/Tests/Unit/PowerBITemplates.Tests.ps1
@@ -175,7 +175,7 @@ Describe 'Power BI templates' {
         $script:sourceParameters.storage.Keys | Should -Contain 'Storage URL'
     }
 
-    It 'Has 6 <_> templates' -ForEach 'kql', 'storage' {
+    It 'Has a <_> template per report' -ForEach 'kql', 'storage' {
         if (-not $script:anyBuilt) { Set-ItResult -Skipped -Because $script:notBuilt; return }
 
         # One template per report in reports.json, named <report>.<type>
@@ -183,10 +183,9 @@ Describe 'Power BI templates' {
         $expected = @($script:config.PSObject.Properties.Name | ForEach-Object { "$_.$type" } | Sort-Object)
         $built = @($script:templatePath.Keys | Where-Object { $_.EndsWith(".$type") } | Sort-Object)
         $built | Should -Be $expected
-        $built.Count | Should -Be 6
     }
 
-    It 'Has a PowerBI-<_>.zip with the same 6 templates' -ForEach 'kql', 'storage' {
+    It 'Has a PowerBI-<_>.zip with the same templates' -ForEach 'kql', 'storage' {
         $zip = Join-Path $script:releaseDir "PowerBI-$_.zip"
         if (-not (Test-Path $zip)) { Set-ItResult -Skipped -Because "release/PowerBI-$_.zip is not built. $script:notBuilt"; return }
 
@@ -326,7 +325,7 @@ Describe 'Power BI template <Label>' -ForEach $templates {
         if ($reason = Get-SkipReason) { Set-ItResult -Skipped -Because $reason; return }
 
         # A name in front of the endpoint is an account. Help text only mentions the bare endpoint.
-        $pattern = '(?i)[a-z0-9][a-z0-9-]*\.(?:dfs|blob)\.core\.windows\.net|[a-z0-9][a-z0-9-]*\.[a-z0-9]+\.kusto\.windows\.net'
+        $pattern = '(?i)[a-z0-9][a-z0-9-]*\.(?:dfs|blob)\.core\.windows\.net|[a-z0-9][a-z0-9-]*\.[a-z0-9]+\.kusto\.windows\.net|[a-z0-9][a-z0-9-]*(?:\.[a-z0-9]+)?\.kusto\.fabric\.microsoft\.com'
         $found = [regex]::Matches($script:allText, $pattern) | ForEach-Object { $_.Value } | Sort-Object -Unique
         $found | Should -BeNullOrEmpty -Because 'templates ship without a data source'
     }
diff --git a/src/scripts/Package-PowerBI.ps1 b/src/scripts/Package-PowerBI.ps1
index a87b3fb83..fa69ae710 100644
--- a/src/scripts/Package-PowerBI.ps1
+++ b/src/scripts/Package-PowerBI.ps1
@@ -445,6 +445,23 @@ if ($Status)
 
 #endregion Report status
 
+#region Validate templates
+
+# Templates are already built at this point, so this doesn't depend on saving PBIX files
+if ($ValidateTemplates)
+{
+    if ($null -ne $IsWindows -and -not $IsWindows)
+    {
+        throw 'Validating templates needs Power BI Desktop, which only runs on Windows. Run this command on Windows, or leave out -ValidateTemplates.'
+    }
+
+    Write-Host ''
+    Write-Host 'Opening the templates in Power BI Desktop...'
+    $null = & "$PSScriptRoot/Test-PowerBITemplates.ps1" -Path $pbitDir
+}
+
+#endregion Validate templates
+
 #region Save PBIX files
 
 # Fail before saving (which takes about an hour for all reports) when the build can't be released
@@ -574,18 +591,6 @@ if ($failed -gt 0)
     throw "$failed demo report$(if ($failed -ne 1) { 's' }) failed validation. Fix the issues above, save again (or run ./Package-PowerBI -Unattended), and rerun this command."
 }
 
-if ($ValidateTemplates)
-{
-    if ($null -ne $IsWindows -and -not $IsWindows)
-    {
-        throw 'Validating templates needs Power BI Desktop, which only runs on Windows. Run this command on Windows, or leave out -ValidateTemplates.'
-    }
-
-    Write-Host ''
-    Write-Host 'Opening the templates in Power BI Desktop...'
-    $null = & "$PSScriptRoot/Test-PowerBITemplates.ps1" -Path $pbitDir
-}
-
 Write-Host ''
 if ($demoZipCurrent)
 {
diff --git a/src/scripts/Test-PowerBITemplates.ps1 b/src/scripts/Test-PowerBITemplates.ps1
index 835a7386d..d7dc1173f 100644
--- a/src/scripts/Test-PowerBITemplates.ps1
+++ b/src/scripts/Test-PowerBITemplates.ps1
@@ -470,7 +470,7 @@ function Test-Template([System.IO.FileInfo] $Template)
                 {
                     $unexpected.Add("'$title' dialog$(if ($page) { ": $($page.Text.Substring(0, [Math]::Min(300, $page.Text.Length)))" })")
                 }
-                if ($title -eq $label) { $prompt = $page }
+                if ($title -eq $label -and $page) { $prompt = $page }
             }
 
             $result.Screenshot = Save-Screenshot (Join-Path $ScreenshotPath "$label.png")