Power BI REST API – Missing Application Permissions(Dataset.ReadWrite.All etc) for Service Principal

[Gauri_Tope]

I'm building an automation pipeline to publish Power BI reports via REST API from AWS Lambda using a registered Azure app (service principal).

My Azure App is registered successfully, and I’ve assigned Power BI Pro and Global Admin roles. However, I:

Cannot see Dataset.ReadWrite.All, Report.ReadWrite.All, or Workspace.ReadWrite.All in Application permissions on Microsoft Azure Portal, only can see Tenant.Read.All and Tenant.ReadWrite.All.

Cannot find the setting “Allow service principals to use Power BI APIs” in Power BI Admin Portal

I’m on Microsoft 365 Business Basic + Power BI Pro.

❓Is this a licensing limitation of Power BI or Microsoft? Do I need Power BI Premium or Entra P2?

❓How can I assign Power BI Service Administrator role or enable tenant-level API access?

❓Any alternative for using service principal authentication?

It would be greatly appreciated if anyone could help me with the above. Thank you in advance!

[Poojara_D12 · Accepted solution]

Hi @Gauri_Tope 

Your use case involves programmatically publishing Power BI reports via the REST API using a service principal registered in Azure AD, and the issue you're encountering—missing permissions like Dataset.ReadWrite.All, Report.ReadWrite.All, and the absence of the “Allow service principals to use Power BI APIs” setting in the Power BI Admin Portal—likely stems from a combination of licensing and tenant-level configuration limitations. Specifically, while Power BI Pro provides access to many core features, service principal support for REST API operations is a capability that requires Power BI Premium (via a P SKU or Fabric capacity) or at minimum Power BI Embedded (A SKUs) to enable service principal authentication and automation scenarios. Furthermore, certain administrative settings—such as allowing service principals to access Power BI APIs—are only visible in the Power BI Admin Portal to users who are Power BI service administrators or Microsoft 365 global administrators, and your current M365 Business Basic plan may not expose all enterprise-level governance features. To resolve this, you will need to ensure that (1) the service principal is granted API permissions through Azure AD under the "API permissions" tab with delegated/admin consent, (2) the Power BI tenant settings are updated to allow service principals (which requires admin access), and (3) your workspace is hosted under a Premium capacity to allow service principal-based automation. In summary, your setup may be limited due to both licensing constraints (lack of Premium) and role permissions (not being a service admin), so enabling automation at scale through service principals will require elevating both your admin privileges and Power BI licensing tier.

[V-yubandi-msft]

Hi @Gauri_Tope ,

I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.

Thank You.

[Gauri_Tope]

Hi @Poojara_D12 & @Yugandhar,
Thank you both for your detailed responses and the valuable guidance.

@Poojara_D12 – Your explanation regarding the licensing and tenant-level constraints really helped me understand why service principal support for REST API wasn’t working under my current setup (Power BI Pro + Microsoft 365 Business Basic). I now realize that Premium capacity or Fabric SKUs are needed for proper service principal authentication.

@Yugandhar – Thanks for reinforcing that with those helpful Microsoft Learn links. They added a lot of clarity, especially around Entra roles and developer settings.

I’ll explore upgrading to Premium and enabling the correct admin configurations as next steps.
Really appreciate your time and support - Marking this thread as resolved, thanks again for the helpful solution!

Best regards,
Gauri Tope

[V-yubandi-msft · Accepted solution]

Hi @Gauri_Tope ,

Thank you for reaching out to the Fabric Community.

@Poojara_D12 , provided some good  insights . Thank you, @Poojara_D12 , for your valuable input.

In addition to her response, I’ve attached a few helpful reference documents. If you get a chance to go through them, they should offer further clarification regarding Service Principals and Permissions in Power BI.

Helpful Reference:

Microsoft Entra built-in roles - Microsoft Entra ID | Microsoft Learn
Developer admin settings - Microsoft Fabric | Microsoft Learn
Embed Power BI content in an embedded analytics application with service principal and an applicatio...

We encourage you to stay connected with the community for any future questions and discussions. Looking forward to your continued participation.

Regards,

Yugandhar.

[Gauri_Tope]

I'm building an automation pipeline to publish Power BI reports via REST API from AWS Lambda using a registered Azure app (service principal).

My Azure App is registered successfully, and I’ve assigned Power BI Pro and Global Admin roles.

However, I:

1. Cannot see Dataset.ReadWrite.All, Report.ReadWrite.All, or Workspace.ReadWrite.All in Application permissions.
2. Only can see Tenant.Read.All and Tenant.ReadWrite.All.
3. Cannot find the setting “Allow service principals to use Power BI APIs” in Power BI Admin Portal

I’m on Microsoft 365 Business Basic + Power BI Pro.

❓Is this a licensing limitation of my Power BI or Microsoft account? Do I need Power BI Premium or Entra P2?

❓How can I assign Power BI Service Administrator role or enable tenant-level API access?

❓Any alternative for using service principal authentication?

It would be greatly appreciated if anyone could help me with the above. Thank you in advance!

[Poojara_D12]

Hi @Gauri_Tope 

When you publish a template app to AppSource in Power BI, users who want to install and use it must meet specific licensing requirements set by Microsoft. Users with only a free Power BI license are restricted and cannot install or use apps that require Pro or Premium features—this includes apps that connect to external data sources, access shared content, or originate from outside the user’s own tenant. Since you, as the data provider, are offering the app but not hosting the workspace or managing access on behalf of the client, the responsibility to meet licensing requirements lies with the client. For your clients with only free licenses to successfully use the app, they must either purchase and assign individual Power BI Pro licenses to relevant users or ensure their organization has a Power BI Premium capacity (either through a P SKU or Fabric capacity). With Premium capacity in place, free users can consume content deployed within a Premium workspace in their own tenant. Therefore, your available options are to either recommend that your clients invest in Pro licenses for their users or ensure they host the app within their own Premium-capacity workspace. Without one of these licensing setups, users with only a free license will not be able to access or use your AppSource template app effectively.

[Gauri_Tope]

Thank you for your response! I appreciate your insight, though my use case is a bit different.

I'm not publishing a template app to AppSource - I'm building an automation pipeline using a registered Azure app (service principal) to publish Power BI reports via REST API from AWS Lambda.

The challenge I'm facing is that I can’t see the required application permissions like Dataset.ReadWrite.All, Report.ReadWrite.All or Workspace.ReadWrite.All on Microsoft Azure Portal. I also don’t see the tenant settings like “Allow service principals to use Power BI APIs” in the Power BI Admin Portal.

I’m currently on Power BI Pro + Microsoft 365 Business Basic, and I’m trying to understand whether this is a licensing or tenant configuration issue, and what’s needed to enable service principal access for this kind of automation.

Thanks again for your time!

[Poojara_D12 · Accepted solution]

Hi @Gauri_Tope 

Your use case involves programmatically publishing Power BI reports via the REST API using a service principal registered in Azure AD, and the issue you're encountering—missing permissions like Dataset.ReadWrite.All, Report.ReadWrite.All, and the absence of the “Allow service principals to use Power BI APIs” setting in the Power BI Admin Portal—likely stems from a combination of licensing and tenant-level configuration limitations. Specifically, while Power BI Pro provides access to many core features, service principal support for REST API operations is a capability that requires Power BI Premium (via a P SKU or Fabric capacity) or at minimum Power BI Embedded (A SKUs) to enable service principal authentication and automation scenarios. Furthermore, certain administrative settings—such as allowing service principals to access Power BI APIs—are only visible in the Power BI Admin Portal to users who are Power BI service administrators or Microsoft 365 global administrators, and your current M365 Business Basic plan may not expose all enterprise-level governance features. To resolve this, you will need to ensure that (1) the service principal is granted API permissions through Azure AD under the "API permissions" tab with delegated/admin consent, (2) the Power BI tenant settings are updated to allow service principals (which requires admin access), and (3) your workspace is hosted under a Premium capacity to allow service principal-based automation. In summary, your setup may be limited due to both licensing constraints (lack of Premium) and role permissions (not being a service admin), so enabling automation at scale through service principals will require elevating both your admin privileges and Power BI licensing tier.