API to grant report acess

[luigisax89]

Hi everyone,

I’m looking for the best solution to my problem. We have Power BI Service where we upload reports and share them with colleagues via direct access. I want to automate access management through APIs. So, if a user changes departments and should no longer see a report, they are automatically removed. Conversely, if they are added to a department, they should gain access to the report. What are the best practices? Are there APIs to add or remove users with direct access?

Thx

[v-pnaroju-msft]

Thankyou, @cengizhanarslan for your response.

Hi luigisax89,

We appreciate your inquiry submitted to the Microsoft Fabric Community Forum.

As suggested by @cengizhanarslan , the best approach is to create department based Entra ID security groups and grant those groups access at the workspace level so that all reports inherit the security settings.
Based on our understanding, Power BI REST APIs allow adding or removing users or groups at the workspace level using Groups – Add/Delete User.

Please refer to the links provided below:
Groups - Add Group User - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Groups - Delete User In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Groups - Update Group User - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Workspaces in Power BI - Power BI | Microsoft Learn

We hope the information furnished helps to resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.

[cengizhanarslan · Accepted solution]

1. Create Entra ID groups per department (or per access bundle), e.g. PBI_Sales_Readers, PBI_Finance_Readers.

2. Grant the group access to the report.

3. Your HR/IT system updates group membership when department changes.

Result: users automatically gain/lose access without touching Power BI items.