Forum Discussion
Community ChampionPower BI Rest API: Delegated permissions vs. Service principal
Hi frithjof_v
I'll try to answer these questions in my own words, maybe not precisely, but probably easier to understand.
In order to use the Power BI Rest API, we need to create an app registration. And we will use this App to go through Microsoft Entra ID authentication process and get access token for querying Power BI REST APIs. There are two types of authentication here: master user and service principal.
- Master user: this authentication will use your Power BI account. You provide your username (Microsoft Entra ID account, the same as your Power BI account) and password (or certificate). MFA is probably needed if your organization has enabled that. In this way, you need to give the app registration specific Delegated permissions to use the APIs. When using Power BI REST APIs, your permissions are limited by the delegated permissions and you can only access resources which you have access to.
- Service principal: this authentication doesn't use any user account. It can act like a "user". You don't have to give the app registration Delegated permissions. Its permissions are managed in Power BI Service and Power BI Admin portal. You can add it to workspace roles directly, or add it to a security group then add the security group to workspace roles. In this way, the "service principal" of an App is activated and it has the permissions for the role it has in Power BI.
You can play around by creating two Apps, one for master user and the other for service principal, to experience the differences of both. Based on my previous test results, it is recommended to handle the two types of authentications by using different apps. Mixing them in one app may cause some authentication conflict errors/failures when the app is used in a scenario where one authentication type is not supported.
Here are some blogs and documentations for your reference:
Use Power BI API with service principal (Preview) | Microsoft Power BI Blog | Microsoft Power BI
Best Regards,
Jing
If this post helps, please Accept it as Solution to help other members find it. Appreciate your Kudos!
Super UserIf you have a Pro license you can open a Pro ticket at https://admin.powerplatform.microsoft.com/newsupportticket/powerbi
Otherwise you can raise an issue at https://community.fabric.microsoft.com/t5/Issues/idb-p/Issues .
Community ChampionI'm hoping someone can answer here so I don't need to create a support ticket for this question.
I think the answer to this question will be useful for many (if not all) users who are using the Power BI REST API.
Hi frithjof_v
I'll try to answer these questions in my own words, maybe not precisely, but probably easier to understand.
In order to use the Power BI Rest API, we need to create an app registration. And we will use this App to go through Microsoft Entra ID authentication process and get access token for querying Power BI REST APIs. There are two types of authentication here: master user and service principal.
- Master user: this authentication will use your Power BI account. You provide your username (Microsoft Entra ID account, the same as your Power BI account) and password (or certificate). MFA is probably needed if your organization has enabled that. In this way, you need to give the app registration specific Delegated permissions to use the APIs. When using Power BI REST APIs, your permissions are limited by the delegated permissions and you can only access resources which you have access to.
- Service principal: this authentication doesn't use any user account. It can act like a "user". You don't have to give the app registration Delegated permissions. Its permissions are managed in Power BI Service and Power BI Admin portal. You can add it to workspace roles directly, or add it to a security group then add the security group to workspace roles. In this way, the "service principal" of an App is activated and it has the permissions for the role it has in Power BI.
You can play around by creating two Apps, one for master user and the other for service principal, to experience the differences of both. Based on my previous test results, it is recommended to handle the two types of authentications by using different apps. Mixing them in one app may cause some authentication conflict errors/failures when the app is used in a scenario where one authentication type is not supported.
Here are some blogs and documentations for your reference:
Use Power BI API with service principal (Preview) | Microsoft Power BI Blog | Microsoft Power BI
Best Regards,
Jing
If this post helps, please Accept it as Solution to help other members find it. Appreciate your Kudos!