Dataset.ReadWrite.All

[VMariapp]

For push dataset, eventhough Dataset.ReadWrite.All is required, can we not restrict that the app registered in AZURE AD for this use case only writes to the dataset in the workspace that we have configured, using service principal??? 

Why it grants access to all datasets in Power BI workspace, Is there any scope and restrict the access to only datasets or Azure AD will work with???

pls suggest some documents also for the steps.

[V-yubandi-msft]

Hi @VMariapp ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[rohit1991]

Hi @VMariapp ,

You’ve raised an important concern regarding the scope of the Dataset.ReadWrite.All permission when using a service principal with Power BI. Currently, this permission is tenant-wide and cannot be scoped to a specific dataset or workspace directly through Azure AD. This means that once granted, the app technically has access to all datasets across all workspaces, unless access is further restricted at the Power BI service level. However, a commonly used approach to mitigate this is to limit the service principal's access by only adding it to the specific workspace that contains the dataset, assigning it a role like Contributor or Member.

As long as the service principal is not added to other workspaces, it won't have visibility or interaction with datasets elsewhere. To tighten security further, in the Power BI Admin Portal, under Tenant Settings, you can enable "Allow service principals to use Power BI APIs" and restrict it to a specific security group rather than allowing access organization-wide. While this doesn't limit the API permission's scope itself, it helps you control which service principals are authorized. For more information, you can refer to Microsoft documentation such as Automate Power BI Premium tasks with service principals and Embed Power BI content with service principal.

Passionate about leveraging data analytics to drive strategic decision-making and foster business growth.

Connect with me on LinkedIn: Rohit Kumar.

[RamyaNatarajan]

Hi @Akash_Varuna @V-yubandi-msft ,

Thank you for taking the time out to reply . Please let me know if the following is an option to restrict the app write to tha push dataset in a workspace?

1. App Registration (Azure AD)

Register your app in Azure AD and grant it Dataset.ReadWrite.All.

---

2. Enable Service Principal Access in Power BI

In Power BI Admin Portal:

Go to Tenant Settings.

Under "Developer settings", enable "Allow service principals to use Power BI APIs".

Restrict this setting to specific security groups, not "entire organization".

---

3. Add the App’s Service Principal to Only One Workspace

Go to the specific workspace where your dataset lives.

Click "Access".

Add the app’s service principal (from the app registration) as a Contributor or Member.

This way:

The app will only see and access the datasets inside that one workspace.

It can’t access any datasets in other workspaces (unless explicitly added).

Kindly let me know if the above would work?

[V-yubandi-msft]

Your approach restricts the app visibility within Power BI, allowing it to interact only with datasets in the specific workspace it has been added to. However, since Dataset.ReadWrite.All is a tenant wide permission, if the service principal gains access to another workspace, it will also be able to interact with datasets there.

Thank You.

[V-yubandi-msft]

Hi @VMariapp ,

Thank you for reaching out to the Microsoft Fabric Community.

In addition to @Akash_Varuna  response, here are some official resources that explain the Dataset.ReadWrite.All permission.

Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Mi...
Embed Power BI content in an embedded analytics application with service principal and an applicatio...

The Dataset.ReadWrite.All permission is tenant-wide and cannot currently be scoped to a specific dataset or workspace when using a service principal.

If my response solved your query, please mark it as the Accepted solution to help others find it easily. And if my answer was helpful, I'd really appreciate a 'Kudos'.

[Akash_Varuna · Accepted solution]

Hi @VMariapp  I don't think it's possible to restrict the Dataset.ReadWrite.All permission to specific datasets or workspaces when using a service principal. This permission inherently grants access to all datasets across Power BI. To limit scope, you can use dedicated workspaces, apply RLS for data-level control, or create a custom middleware to filter API calls. For more details, check Power BI REST API and Azure AD permissions documentation.