Forum Discussion
App Service Principals vs Admin API Service Principals
Hi dibaSFP ,
Service Principal authentication for scanner Admin APIs will enable Azure AD applications to access Power BI APIs, without the need for admins to maintain a service account with an admin role. Only approval through tenant settings configurations will need to be granted to allow this action to be performed.
You can learn more about the difference between read-only Power BI admin APIs and Power BI APIs by Announcing new Admin APIs and Service Principal authentication to make for better tenant metadata scanning
If the problem is still not resolved, please provide detailed error information or the expected result you expect. Let me know immediately, looking forward to your reply.
Best Regards,
Winniz
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Dear Winniz,
thank you for the explanation. The main question is, why the "App Service Principals" cannot get the permission to access the read-only APIs as well (e.g. by assigning them the Tenant.ReadAll permission). The other way around is understandable.
The (way more efficient) read-only Admin APIs have been added, e.g. to avoid reading all workspace, reports and dataset data by looping through each and every workspace and scan on changes (which - according to some blog entries - may have needed more than 24 hours for some customers).
You have the same requirement in your own Power BI Embedded solution, e.g. to add a new report automatically to your own app, if it has been added to a PBI service workspace. To recognize that, you have to check the workspaces frequently - which would be way more efficient, if just the read-only APIs could also be accessed by the App Service Principal as well (as there are APIs which return a list of changed workspaces and all the details by only sending two requests).
Regards,
DibaSFP