Forum Discussion
Set build permission on dataset/semantic model to app using REST API
Hi KimTutein , Thank you for reaching out to the Microsoft Fabric Community Forum.
You are correct, an Azure AD app registration is a service principal and service principals are valid principals in the Put Dataset User API. In theory you should be able to grant ReadExplore (Build) that way.
The issue is that, in practice, assigning Build to a service principal through the REST API doesn’t actually work consistently today, even though the UI supports it. This is why you’re able to add Build permission for your app in the GUI, but the same call through the API won’t succeed. It’s a limitation in the current implementation, not something you’re doing wrong.
Hi KimTutein , Thank you for reaching out to the Microsoft Fabric Community Forum.
You cannot assign Build permission directly to an App using the REST API. Apps aren’t valid principals; only users, security groups and service principals are supported.
Instead, register the app with Azure AD, use a service principal and then grant that SPN Build permission on the dataset via the REST API. This way, the app can authenticate with the service principal and securely run queries against the dataset.
Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn