Forum Discussion
Dataset.ReadWrite.All
Hi Anonymous I don't think it's possible to restrict the Dataset.ReadWrite.All permission to specific datasets or workspaces when using a service principal. This permission inherently grants access to all datasets across Power BI. To limit scope, you can use dedicated workspaces, apply RLS for data-level control, or create a custom middleware to filter API calls. For more details, check Power BI REST API and Azure AD permissions documentation.
Hi Anonymous ,
You’ve raised an important concern regarding the scope of the Dataset.ReadWrite.All permission when using a service principal with Power BI. Currently, this permission is tenant-wide and cannot be scoped to a specific dataset or workspace directly through Azure AD. This means that once granted, the app technically has access to all datasets across all workspaces, unless access is further restricted at the Power BI service level. However, a commonly used approach to mitigate this is to limit the service principal's access by only adding it to the specific workspace that contains the dataset, assigning it a role like Contributor or Member.
As long as the service principal is not added to other workspaces, it won't have visibility or interaction with datasets elsewhere. To tighten security further, in the Power BI Admin Portal, under Tenant Settings, you can enable "Allow service principals to use Power BI APIs" and restrict it to a specific security group rather than allowing access organization-wide. While this doesn't limit the API permission's scope itself, it helps you control which service principals are authorized. For more information, you can refer to Microsoft documentation such as Automate Power BI Premium tasks with service principals and Embed Power BI content with service principal.