How to Register Service Principle in Tenet level Power BI Admin

Hi dkDinesh2810 - Configuring a Service Principal at the tenant level in Power BI, rather than at the workspace level, involves granting tenant-wide permissions for the Service Principal to access resources in your Power BI environment. This approach ensures that the Service Principal can interact with multiple workspaces and datasets across the tenant based on its assigned permissions.

Service Principals do not natively manage tenant-level "Connections." Instead, you can manage connections at the workspace or gateway level and use the Service Principal to automate and standardize configurations.

Ensure proper governance by restricting access to only authorized Service Principals to avoid potential misuse.

To allow Service Principal access at the tenant level:

Go to the Power BI Admin Portal:
Navigate to Settings > Admin Portal in the Power BI Service.
Enable Service Principal Authentication:
In the Tenant settings, find the section Allow service principals to use Power BI APIs.
Turn this setting ON.
Add the security group containing your Service Principals or enable it for the entire organization.

Hope this helps.

Hi dkDinesh2810 

To register a Service Principal at the tenant level in Power BI, follow these steps:

Key Steps:

1. Enable Service Principal for the Tenant:

   • In the Power BI Admin Portal, under Tenant Settings, enable Allow service principals to use Power BI APIs.
   • Specify security groups containing the Service Principals for proper scoping.

2. Grant API Permissions:

   • In Azure Active Directory (Azure AD), locate the Service Principal.
   • Assign the required Power BI API permissions (e.g., Power BI Service.Read.All, Dataset.ReadWrite.All) and grant admin consent.

3. Configure Data Source Connections:

   • Service Principals work at the tenant level, not workspace-specific, for API calls and automations.
   • However, data source-specific configurations (e.g., DEV, Pre-Prod, Prod) are still managed within respective workspaces or datasets.
   • Use automation scripts (via PowerShell or REST APIs) to assign Service Principal permissions to individual workspaces and configure their connections.

4. Alternative: Use a centralized workspace or a deployment pipeline to manage DEV, Pre-Prod, and Prod connections with the Service Principal.

Important Notes:

• Power BI currently doesn’t offer direct tenant-level configuration for connections. Each connection must be set up per workspace or dataset.
• Use tools like PowerShell and APIs to automate and streamline the configuration across environments.

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to drop me a "Kudos" 🙂

Kind Regards,
Poojara
Data Analyst | MSBI Developer | Power BI Consultant
Please Subscribe my YouTube for Beginners/Advance Concepts: https://youtube.com/@biconcepts?si=04iw9SYI2HN80HKS 

Thanks for the reply from , please allow me to add some more information.
Hi dkDinesh2810 ,

The following settings need to be enabled when running the following series of APIs under service principal authentication.

Admin - REST API (Power BI Power BI REST APIs) | Microsoft Learn


Enable the "Service principals can access read-only admin APIs" feature for security groups that contain service principals.

An app using service principal authentication that calls read-only admin APIs must not have any admin-consent required permissions for Power BI set on it in the Azure portal.

Enable service principal authentication for read-only admin APIs - Microsoft Fabric | Microsoft Learn

Best Regards,
Dengliang Li

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Hi dkDinesh2810 ,

Is my follow-up just to ask if the problem has been solved?

If so, can you accept the correct answer as a solution or share your solution to help other members find it faster?

Thank you very much for your cooperation!