Call Power BI REST API without delegated permissions

[SMR1989]

Hello, we need to use the Power BI API in order to get metadata about data refresh from an external app.

It looks like the only valid authentication method is through delegated permissions, but for security reasons, we can't have a single user with access to every workspace in the company.

Anybody knows if there is any other authentication method to get metadata of every dataset in the company without a generic user with access to all workspaces?

Thank you!

[SMR1989 · Accepted solution]

Finally, our approach was to create a service principal in Azure. 

Use Azure service principals with Azure PowerShell | Microsoft Docs 

[v-lionel-msft]

Hi @SMR1989 ,

" I wonder if we could create a user with access to ALL datasets, but with no access to power bi service. So that this user can only access to the dataset throught the API."

I suddenly thought that maybe you can use O365 administrator account to get Audit log instead of API.

Best regards,
Lionel Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[SMR1989]

Hi @v-lionel-msft, thank you so much for your support. Finally, it seems that we found the solution creating a "service principal" in Azure. 

[v-lionel-msft]

Hi @SMR1989 ,

“Anybody knows if there is any other authentication method to get metadata of every dataset in the company without a generic user with access to all workspaces?”

If the current account does not have the build permission of the dataset, it is impossible to obtain the dataset through the API. So your idea cannot be realized. You may need different accounts to obtain the corresponding data set information, and then merge them.

Best regards,
Lionel Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[SMR1989]

Hi @v-lionel-msft,

Thanks for your answer, I really appreciate your point of view and we will evaluate the approach of using several accounts and merge the data.

In order to explore all the possibilities, I wonder if we could create a user with access to ALL datasets, but with no access to power bi service. So that this user can only access to the dataset throught the API.

Thanks for your support!