Limit Service Principal to access only a specific Workspace

Hi all,

I'm building a application and use Power BI embedded for the Analytics and reporting part of my application. My applicaiton is a multi-tenant environment, and I'm planning to use one Workspace for each of my tenants.

For more security I was thinking for each tenant to:

- register one Azure AD applicaiton

- add a Service Principal for this application

- create a Workspace and limit the access to only the tenant service principal

I've try this, but unfortunately all Service principal can access all workspaces.

My Questions:

1. is this the proper way to manage the multi-tenancy in Power BI embedded?

2. Do I really have to create one applicaiton per tenant?

3. Can I create only one application, then one Service Principal for each of tenant

4. How to limit a tenant to access only 1 Workspace.

By advance many thanks