APP registration - API permissions

[urraghu]

Hi,

Regarding registration of an App in Azure AD through below power-bi App registration tool.

https://docs.microsoft.com/en-us/power-bi/developer/embedded/register-app

https://dev.powerbi.com/apps

From governance and security perspective, want to know what each of API permissions are for. any documentation/pointers explaining each API access/permission scope would be helpful.

I believe APP that should be registered is the  workspace which becomes APP once published..

By granting " Read and Write All data sets" .. would this application and developer signed in get read/write access to all data sets of all work spaces in the tenant or only the data sets of the App/workspace being registered?

Similarly, other permissions like "Read and Write all workspaces/dashboards" ?? 

By name it sounds like developer registering the app would get access through API to all data sets/reports/dashboards when those respective permissions are given. But wondering why one should have access to other workspaces/datasets outside his App/workspace which is being registered?

[Anonymous · Accepted solution]

Hi @urraghu,

#1, Nope, I don't think these users can view all contents. If they not have admin permission, they can only view the public and the contents they get permission to access. (for personal workspace contents, admin also not has permission to view)

Power BI REST APIs 

#2, AFAIK, these operations are work on the azure side and mapping with user credentials. If users want to operate on power bi content, they will also verify the AAD credentials and power bi permissions.

Get an authentication access token 
In addition, you can also check the audit log function which will log the activity of different users. (these operations are based on his credentials, so they will also record into audit logs)

Track user activities in Power BI 

Regards,

Xiaoxin Sheng