Fabric Rest Api

[jp_golay]

Hi we use Fabric Rest API for a tool creating Backup and MCP around Power BI items.

We need to use a service principal as we are in a backend task, but surprisingly we are not able to scan the personal workspaces.

We have been told that is by design by Microsoft??? So there is no API ( and no other manual way) for any kind of supervisor to know what happens in the user personal workspaces!!!

For example a user can make a collection of critical reports and export them with data this is authorised but to let a supervisor see what he do not?

For my customer it's a major issue and a compliance problem (he cannot backup personal workspaces)

any other people concerned by such issue?

we are looking for help to make thinks changes. Microsoft support after long exchanges,just responded that it's a out of scope of their influence ...

thanks for your feedback in the comments I will send directly to MS so be diligent 

Jean-Philippe

[Jai-Rathinavel · Accepted solution]

Hi @jp_golay , There are APIs available in the Power BI Rest API Documentation to extract artifacts metadata from personal workspaces as well. You would have to use the below four APIs hand in hand to achieve that. 

Rest API Documentation: https://learn.microsoft.com/en-us/rest/api/power-bi/admin

Please note that the below APIs require admin access to the Service principal. Make sure service principal can access Admin APIs by configuring the Admin portal settings.

Thanks,

Jai

[MohdZaid_ · Accepted solution]

Hey @jp_golay  , 

In Microsoft Fabric and Power BI, service principals cannot access personal (“My workspace”) workspaces by default, and this is largely by design for privacy and compliance reasons. Standard Fabric REST APIs will not return personal workspaces when called by a normal service principal. However, governance access is possible through the Power BI Admin REST APIs, not the regular APIs.

If the service principal is added to a security group that has Power BI Service Admin or Fabric Admin rights, and tenant settings allow service principals to use Power BI APIs, then the Admin workspace scan endpoints (with the includePersonalWorkspaces flag enabled) can retrieve metadata for personal workspaces. For compliance and monitoring, organizations can also use Microsoft 365 audit logs and optionally Microsoft Purview. There is no supported way for a non-admin service principal to fully enumerate personal workspaces, so the practical solution is to use an admin-level service principal combined with Admin APIs and audit logging.

[v-nmadadi-msft]

Hi @jp_golay 

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you

[v-nmadadi-msft]

Hi @jp_golay 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

[GilbertQ]

Hi @jp_golay 

My solution would be why don't you use the scanner API which will. Then give you all the information about my workspaces for personal users and when using the scanner API you can run this using a service principle account.

Admin - WorkspaceInfo GetModifiedWorkspaces - REST API (Power BI Power BI REST APIs) | Microsoft Lea...

[Nasif_Azam · Accepted solution]

Hey @jp_golay ,

This is a confirmed by-design limitation. Microsoft explicitly states "My Workspace isn't supported when using service principal." However, the situation is not completely hopeless. Here are some workarounds available:

Workaround-1: Admin APIs DO Return Personal Workspace Metadata (via Service Principal)

Even though you can't access content via service principal, you can discover and scan personal workspaces:

• GET /v1.0/myorg/admin/groups?$top=5000 which returns personal workspaces as type PersonalGroup
• Scanner/WorkspaceInfo API (/v1.0/myorg/admin/workspaces/getInfo) which can scan personal workspaces for deeper metadata (reports, datasets, lineage, datasource details)
• Both support service principal authentication when "Admin API Settings > Service principals can access read-only admin APIs" is enabled

Workaround-2: Delegated Admin Token for Full Content Backup

For actual content backup (export .pbix, definitions, etc.), replace the service principal with a Fabric Admin delegated user account:

• Fabric Admin calls Admin Portal > Workspaces > "Get Access" on target personal workspaces (this can be done via API: POST /v1.0/myorg/admin/groups/{groupId}/users to add the admin user)
• Once the admin user has access, use delegated token (OAuth authorization_code flow) to call export APIs against those personal workspaces
• Automate token refresh using a secured service account with Fabric Admin role

Workaround-3: Prevent the Problem with Governance Policies

• Disable/restrict personal workspaces at the tenant level force all content into governed shared workspaces
• Block export with data via tenant settings if that's the compliance risk
• Block users from reassigning personal workspaces to prevent capacity/data residency issues
• Use sensitivity labels + DLP to prevent sensitive data from being moved to ungoverned spaces

For Detailed Information:

• Embed Power BI Content with Service Principal — Limitations

• Admin API — GetGroupsAsAdmin (List All Workspaces Including Personal)

• Admin API — WorkspaceInfo PostWorkspaceInfo (Scanner API)

• Admin API — AddUserAsAdmin (Grant Access to Workspaces)

• Manage Workspaces — Fabric Admin Portal (Get Access to Personal Workspaces)

• Fabric REST API — List Workspaces (Core API)

Best Regards,
Nasif Azam

[Olufemi7]

Hello @jp_golay, 

Service principals cannot access personal workspaces (“My Workspace”) in Power BI/Fabric; only shared or app workspaces where the SP is explicitly added are accessible via REST API. Personal workspaces remain private by design for user privacy.

Microsoft Docs:
Embed Power BI content with service principal and an application secret 

[MohdZaid_ · Accepted solution]

Hey @jp_golay  , 

In Microsoft Fabric and Power BI, service principals cannot access personal (“My workspace”) workspaces by default, and this is largely by design for privacy and compliance reasons. Standard Fabric REST APIs will not return personal workspaces when called by a normal service principal. However, governance access is possible through the Power BI Admin REST APIs, not the regular APIs.

If the service principal is added to a security group that has Power BI Service Admin or Fabric Admin rights, and tenant settings allow service principals to use Power BI APIs, then the Admin workspace scan endpoints (with the includePersonalWorkspaces flag enabled) can retrieve metadata for personal workspaces. For compliance and monitoring, organizations can also use Microsoft 365 audit logs and optionally Microsoft Purview. There is no supported way for a non-admin service principal to fully enumerate personal workspaces, so the practical solution is to use an admin-level service principal combined with Admin APIs and audit logging.

[Jai-Rathinavel · Accepted solution]

Hi @jp_golay , There are APIs available in the Power BI Rest API Documentation to extract artifacts metadata from personal workspaces as well. You would have to use the below four APIs hand in hand to achieve that. 

Rest API Documentation: https://learn.microsoft.com/en-us/rest/api/power-bi/admin

Please note that the below APIs require admin access to the Service principal. Make sure service principal can access Admin APIs by configuring the Admin portal settings.

Thanks,

Jai

[rohit1991]

Hii @jp_golay 

Service principals and REST APIs cannot access or scan personal workspaces (My Workspace) because they are user-owned and isolated for privacy and security. There is no supported API or admin method to back up or monitor personal workspaces. Only shared (group-based) workspaces are accessible via service principal, so critical content must be moved there for compliance and backup.