Forum Discussion
Dataset.ReadWrite.All
Hi Anonymous I don't think it's possible to restrict the Dataset.ReadWrite.All permission to specific datasets or workspaces when using a service principal. This permission inherently grants access to all datasets across Power BI. To limit scope, you can use dedicated workspaces, apply RLS for data-level control, or create a custom middleware to filter API calls. For more details, check Power BI REST API and Azure AD permissions documentation.
Hi Akash_Varuna V-yubandi-msft ,
Thank you for taking the time out to reply . Please let me know if the following is an option to restrict the app write to tha push dataset in a workspace?
1. App Registration (Azure AD)
Register your app in Azure AD and grant it Dataset.ReadWrite.All.
---
2. Enable Service Principal Access in Power BI
In Power BI Admin Portal:
Go to Tenant Settings.
Under "Developer settings", enable "Allow service principals to use Power BI APIs".
Restrict this setting to specific security groups, not "entire organization".
---
3. Add the App’s Service Principal to Only One Workspace
Go to the specific workspace where your dataset lives.
Click "Access".
Add the app’s service principal (from the app registration) as a Contributor or Member.
This way:
The app will only see and access the datasets inside that one workspace.
It can’t access any datasets in other workspaces (unless explicitly added).
Kindly let me know if the above would work?
Your approach restricts the app visibility within Power BI, allowing it to interact only with datasets in the specific workspace it has been added to. However, since Dataset.ReadWrite.All is a tenant wide permission, if the service principal gains access to another workspace, it will also be able to interact with datasets there.
Thank You.