How to Restrict a Service Principal's write access to only one Power BI Workspace

[VMariapp]

Please let me know if the following is an option to restrict the app write to tha push dataset in a workspace?

1. App Registration (Azure AD)

Register your app in Azure AD and grant it Dataset.ReadWrite.All.

---

2. Enable Service Principal Access in Power BI

In Power BI Admin Portal:

Go to Tenant Settings.

Under "Developer settings", enable "Allow service principals to use Power BI APIs".

Restrict this setting to specific security groups, not "entire organization".

---

3. Add the App’s Service Principal to Only One Workspace

Go to the specific workspace where your dataset lives.

Click "Access".

Add the app’s service principal (from the app registration) as a Contributor or Member.

This way:

The app will only see and access the datasets inside that one workspace.

It can’t access any datasets in other workspaces (unless explicitly added).

Kindly let me know if the above would work?

[v-bmanikante]

Hi @VMariapp ,

Thank you for reaching out to Microsoft Fabric Community Forum.

@GilbertQ @Cookistador Thank you for your quick responses.

@VMariapp we would like to follow up to see if the solution provided by the super users resolved your issue. Please let us know if you need any further assistance.

If our super user response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Please don't forget to give a "Kudos " – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[v-bmanikante]

Hi @VMariapp ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?

If our response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Please don't forget to give a "Kudos " – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[v-bmanikante]

Hi @VMariapp ,

Thank you for reaching out to Microsoft Fabric Community Forum.

As we haven’t heard back from you, we will go ahead and close this ticket for now.

If you need any further assistance, please don’t hesitate to raise a new ticket, we’re always happy to help.

Our sincere apologies if there was any inconvenience caused.

Regards,

B Manikanteswara Reddy

[GilbertQ]

Hi @VMariapp 

As mentioned above simply put yes this will work as expected.

[Cookistador · Accepted solution]

Your layered approach, combining Azure AD app permissions with Power BI tenant-level and workspace-level access controls, is the recommended and most secure way to achieve your goal. It ensures that while your service principal has the necessary underlying API permissions, its effective scope of action is tightly constrained to only the workspaces and datasets you explicitly allow.

Just always use the least privlige approach in workspace, if contributor is enough, give contributor right 🙂