PowerBI AdminAPIs Service Principal Fine Grained Access

[kkitsara]

Hello,

We have created a service principal to access PowerBI Admin APIs, following this documentation

https://learn.microsoft.com/en-us/fabric/admin/metadata-scanning-enable-read-only-apis

Configuration and integration works properly.

Now we would like to set fine grained access on this service principal. Is there any way this service principal to have access and retrieve the metadata only from specific capacities of the tenant?

If with this approach is not possible, is there maybe another alternative approach to achieve this integration?

Regards,

Kostas

[rajendraongole1 · Accepted solution]

Hi @kkitsara -As of now, the Power BI Admin APIs, including the Metadata Scanning APIs, allow for accessing tenant-wide metadata, but they do not natively support fine-grained access control at the level of specific capacities or workspaces for service principals.

The service principal will need "Power BI Service Administrator" or "Fabric Administrator" role for tenant-wide access, which doesn't currently support granularity at the capacity level. That said, you can manage access at a workspace level by assigning specific roles to the service principal in different workspaces, but this doesn't directly limit API access by capacity.

Possibilities of API admin solved links FYR :

Solved: Service Principal - Can not grant access to my Wor... - Microsoft Fabric Community

Solved: PowerBI API Rest Service Principal Authentication - Microsoft Fabric Community

Enable service principal authentication for read-only admin APIs - Microsoft Fabric | Microsoft Lear...

(1) Solved: Service Principal for semantic model authenticatio... - Microsoft Fabric Community

Hope the above information and links helps you.

[kkitsara]

Hi again,

Comment by @rajendraongole1  is accurate. 

Is there any plan to be resolved and apply fine-grained access there?

Regards,

Kostas

[kkitsara]

Hello,

Following up on this topic, we tried the suggested approach with the security group and the SPN, but it does not work.

Apparently Collibra needs access to PowerBI Admin APIs to get the workspaces' metadata and there is not fine-grained access there, you see always all the capacities/workspaces of the tenant.

Is there any possible solution to this?

Please do not mark this as resolved, because the suggested approach works in general, but not for specific Collibra integration.

Regards,

Kostas

[Anonymous · Accepted solution]

Hi @kkitsara 

Thank you very much rajendraongole1 for your prompt reply.

It is not possible to directly restrict a service principal's access to a specific capacity using the Power BI management API alone. You can try a combination of the following to help you achieve the level of access control you need:

You can create dedicated security groups for your service principals and assign them to specific capacities. This way, the service principal will only have access to the capacities associated with its security group.

You provide that access by adding the app's service principal or its security group to your workspace as a member or admin.

Embed Power BI content in an embedded analytics application with service principal and an applicatio...

You might also want to know what permissions different roles have:

Roles in workspaces in Power BI - Power BI | Microsoft Learn

You can configure tenant settings to allow access only to specific security groups. This involves creating a security group for the service principal and excluding it from the tenant settings that you don't want it to access.

Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Mi...

Regards,

Nono Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[rajendraongole1 · Accepted solution]

Hi @kkitsara -As of now, the Power BI Admin APIs, including the Metadata Scanning APIs, allow for accessing tenant-wide metadata, but they do not natively support fine-grained access control at the level of specific capacities or workspaces for service principals.

The service principal will need "Power BI Service Administrator" or "Fabric Administrator" role for tenant-wide access, which doesn't currently support granularity at the capacity level. That said, you can manage access at a workspace level by assigning specific roles to the service principal in different workspaces, but this doesn't directly limit API access by capacity.

Possibilities of API admin solved links FYR :

Solved: Service Principal - Can not grant access to my Wor... - Microsoft Fabric Community

Solved: PowerBI API Rest Service Principal Authentication - Microsoft Fabric Community

Enable service principal authentication for read-only admin APIs - Microsoft Fabric | Microsoft Lear...

(1) Solved: Service Principal for semantic model authenticatio... - Microsoft Fabric Community

Hope the above information and links helps you.