Forum Discussion
PowerBI AdminAPIs Service Principal Fine Grained Access
Hello,
We have created a service principal to access PowerBI Admin APIs, following this documentation
https://learn.microsoft.com/en-us/fabric/admin/metadata-scanning-enable-read-only-apis
Configuration and integration works properly.
Now we would like to set fine grained access on this service principal. Is there any way this service principal to have access and retrieve the metadata only from specific capacities of the tenant?
If with this approach is not possible, is there maybe another alternative approach to achieve this integration?
Regards,
Kostas
Hi kkitsara -As of now, the Power BI Admin APIs, including the Metadata Scanning APIs, allow for accessing tenant-wide metadata, but they do not natively support fine-grained access control at the level of specific capacities or workspaces for service principals.
The service principal will need "Power BI Service Administrator" or "Fabric Administrator" role for tenant-wide access, which doesn't currently support granularity at the capacity level. That said, you can manage access at a workspace level by assigning specific roles to the service principal in different workspaces, but this doesn't directly limit API access by capacity.
Possibilities of API admin solved links FYR :
Solved: Service Principal - Can not grant access to my Wor... - Microsoft Fabric Community
Solved: PowerBI API Rest Service Principal Authentication - Microsoft Fabric Community
(1) Solved: Service Principal for semantic model authenticatio... - Microsoft Fabric Community
Hope the above information and links helps you.
Hi kkitsara
Thank you very much rajendraongole1 for your prompt reply.
It is not possible to directly restrict a service principal's access to a specific capacity using the Power BI management API alone. You can try a combination of the following to help you achieve the level of access control you need:
You can create dedicated security groups for your service principals and assign them to specific capacities. This way, the service principal will only have access to the capacities associated with its security group.
You provide that access by adding the app's service principal or its security group to your workspace as a member or admin.
You might also want to know what permissions different roles have:
Roles in workspaces in Power BI - Power BI | Microsoft Learn
You can configure tenant settings to allow access only to specific security groups. This involves creating a security group for the service principal and excluding it from the tenant settings that you don't want it to access.
Regards,
Nono Chen
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
4 Replies
- rajendraongole1
Super User
Hi kkitsara -As of now, the Power BI Admin APIs, including the Metadata Scanning APIs, allow for accessing tenant-wide metadata, but they do not natively support fine-grained access control at the level of specific capacities or workspaces for service principals.
The service principal will need "Power BI Service Administrator" or "Fabric Administrator" role for tenant-wide access, which doesn't currently support granularity at the capacity level. That said, you can manage access at a workspace level by assigning specific roles to the service principal in different workspaces, but this doesn't directly limit API access by capacity.
Possibilities of API admin solved links FYR :
Solved: Service Principal - Can not grant access to my Wor... - Microsoft Fabric Community
Solved: PowerBI API Rest Service Principal Authentication - Microsoft Fabric Community
(1) Solved: Service Principal for semantic model authenticatio... - Microsoft Fabric Community
Hope the above information and links helps you.
Hi kkitsara
Thank you very much rajendraongole1 for your prompt reply.
It is not possible to directly restrict a service principal's access to a specific capacity using the Power BI management API alone. You can try a combination of the following to help you achieve the level of access control you need:
You can create dedicated security groups for your service principals and assign them to specific capacities. This way, the service principal will only have access to the capacities associated with its security group.
You provide that access by adding the app's service principal or its security group to your workspace as a member or admin.
You might also want to know what permissions different roles have:
Roles in workspaces in Power BI - Power BI | Microsoft Learn
You can configure tenant settings to allow access only to specific security groups. This involves creating a security group for the service principal and excluding it from the tenant settings that you don't want it to access.
Regards,
Nono Chen
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Hello,
Following up on this topic, we tried the suggested approach with the security group and the SPN, but it does not work.
Apparently Collibra needs access to PowerBI Admin APIs to get the workspaces' metadata and there is not fine-grained access there, you see always all the capacities/workspaces of the tenant.
Is there any possible solution to this?
Please do not mark this as resolved, because the suggested approach works in general, but not for specific Collibra integration.
Regards,
Kostas
Hi again,
Comment by rajendraongole1 is accurate.
Is there any plan to be resolved and apply fine-grained access there?
Regards,
Kostas
