Forum Discussion
Workspace Security
Hi Power BI Community,
We have a need to occassionally identify what workspaces a user or security group has been granted access.
Is there a way either through the Admin portal or through Power Bi APIs to get this information.
Many Thanks in advance.
DKHughes55
Hi DKHUghes55,
Yes, it is possible to identify which workspaces a user or security group has access to, but this cannot be done directly in Power BI Desktop. There are two main approaches:
Option 1 – Power BI Service Admin Portal
If you have Power BI Admin permissions, you can:- Access the Admin Portal.
- Navigate to Workspaces.
- Export the complete list of workspaces and their associated users or groups.
- Use the Export to CSV feature for further analysis.
Limitation: This is only available to tenant administrators.Option 2 – Power BI REST API
For an automated and scalable solution:- Use the endpoint:
GET https://api.powerbi.com/v1.0/myorg/groups
- This returns all workspaces.
- For each workspace, retrieve the members:
GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/users
Combine the results to obtain a complete list of workspaces per user or group.
Prerequisites:- Register an application in Azure Active Directory.
- Grant permissions to the Power BI API.
- Authenticate using OAuth2.
Official Documentation:If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.
Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.
Hi DKHUghes55 ,
Thank you for reaching out to Microsoft Fabric Community.
Thank you Zanqueta for the prompt response.
Yes, you can identify which workspaces a user or group has access to, but a few clarifications are important:
The Admin Portal does not provide a direct export of users/groups per workspace or a list of workspaces for a specific user-you can only check access one workspace at a time.Power BI also doesn’t offer a single API that returns "workspaces for User X"; you need to list all workspaces and then check members for each.Tenant-wide results are only available if you are a Power BI Admin or a service principal with Admin permissions-otherwise the API shows only workspaces you can access.For admins, PowerShell is often the easiest option: Get-PowerBIWorkspace -All ,Get-PowerBIWorkspaceUser.API and PowerShell output will include users, security groups, M365 groups, and service principals.
5 Replies
Hi DKHUghes55,
Yes, it is possible to identify which workspaces a user or security group has access to, but this cannot be done directly in Power BI Desktop. There are two main approaches:
Option 1 – Power BI Service Admin Portal
If you have Power BI Admin permissions, you can:- Access the Admin Portal.
- Navigate to Workspaces.
- Export the complete list of workspaces and their associated users or groups.
- Use the Export to CSV feature for further analysis.
Limitation: This is only available to tenant administrators.Option 2 – Power BI REST API
For an automated and scalable solution:- Use the endpoint:
GET https://api.powerbi.com/v1.0/myorg/groups
- This returns all workspaces.
- For each workspace, retrieve the members:
GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/users
Combine the results to obtain a complete list of workspaces per user or group.
Prerequisites:- Register an application in Azure Active Directory.
- Grant permissions to the Power BI API.
- Authenticate using OAuth2.
Official Documentation:If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.
Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.
What works — and what you need
• Admin portal (UI)
If you are a tenant (or Fabric) admin, you can open the Admin portal → Workspaces tab. That gives you a list of all workspaces in the tenant. Microsoft Learn+1
For each workspace, you can click “Access” / workspace settings to see which users or groups have permission and what role (Admin/Member/Contributor/Viewer). Microsoft Fabric Community+2Bricks+2
This lets you manually inspect — but if you have many workspaces, manual checking may not scale well.
• REST API (programmatic)
If you want to script or automate the retrieval, you can use the official Power BI REST APIs:
Use Power BI Admin REST API endpoint GetGroupsAsAdmin — GET https://api.powerbi.com/v1.0/myorg/admin/groups — to list all workspaces in the tenant. Microsoft Learn+1
For each workspace (groupId), call GetGroupUsersAsAdmin (or expand users in the API) to get all users and groups assigned to the workspace + their roles. Microsoft Learn+2Microsoft Fabric Community+2
This way you can build a full mapping: Workspace → users/groups → roles.
Limitations & What You Must Have
Only a “tenant/Fabric admin” or a service principal with appropriate admin consent + permissions (Tenant.Read.All or Tenant.ReadWrite.All) can call the admin APIs. Microsoft Learn+2Microsoft Learn+2
Merely being a “global admin” in Azure / M365 doesn’t guarantee you see all workspaces or their membership. Admin-level privileges must be explicitly enabled for Power BI admin APIs. Stack Overflow+2Stack Overflow+2
If you don’t have admin privileges, you’ll only see the workspaces you personally have access to. You cannot discover the permissions of workspaces to which you are not assigned. Microsoft Fabric Community+2Microsoft Fabric Community+2
One user on Reddit explained this trade-off succinctly:
“A list of all workspaces is available in the Admin portal. From there you can grant yourself or others access to the workspace itself.” Reddit+1
Another added:
“You need to use the admin resource if you want to get workspaces you haven't been explicitly assigned permissions to.” Reddit+1
What you can do now — recommended approach
If you have admin rights (or can get them), I recommend:
Use Admin REST API GetGroupsAsAdmin to get all workspaces.
For each workspace, use GetGroupUsersAsAdmin (or the $expand=users parameter) to pull its membership metadata.
Consolidate the results (e.g. in a spreadsheet, JSON, or a database) to produce a “workspace-access matrix” — i.e. which users/groups have which role in which workspace.
If your organization prefers not to use API, you can alternatively use the Admin Portal UI — but that will be manual and tedious if you have many workspaces.
Note: AI helped me to format this response.
Hi DKHUghes55 ,
Thank you for reaching out to Microsoft Fabric Community.
Thank you Zanqueta for the prompt response.
Yes, you can identify which workspaces a user or group has access to, but a few clarifications are important:
The Admin Portal does not provide a direct export of users/groups per workspace or a list of workspaces for a specific user-you can only check access one workspace at a time.Power BI also doesn’t offer a single API that returns "workspaces for User X"; you need to list all workspaces and then check members for each.Tenant-wide results are only available if you are a Power BI Admin or a service principal with Admin permissions-otherwise the API shows only workspaces you can access.For admins, PowerShell is often the easiest option: Get-PowerBIWorkspace -All ,Get-PowerBIWorkspaceUser.API and PowerShell output will include users, security groups, M365 groups, and service principals.Hi DKHUghes55 ,
I wanted to check if you had the opportunity to review the information provided and resolve the issue..?Please let us know if you need any further assistance.We are happy to help.
Thank you.
Hi DKHUghes55 ,
May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.
Thank you.
