Power BI REST APIs - Scoping to specific objects possible?

[daheinri]

Hi everyone,

I'm not familiar with Power BI Rest APIs. One of our departements is using an Anzure App with a service principal. At the moment,

they are able to read all objects in our Tenant, which is not allowed. So I'm looking for some kind of scoping. The only scoping method I used so far, is the Exchange scoping to specific mailboxes, when the Azure App is using application permission, instead of delegated permissions.

That's how the permissions looks like at the moment:

Thanks and best regards

Daniel

[daheinri]

Thanks for responding.

The main question is: Is it possible, to limit the accessible objects for the Power BI Rest API?
I don't want the possibility, to access all objects in the tenant, but only a few specific ones.

[ibarrau · Accepted solution]

The permissions at azure will only specify which actions you are able to do. Think about the azure permissions as tools. You have the tools, but in order to start working you need a desk, or a room. The desk is the permission inside Power Bi Service. You can login in two ways:

- Master user: username and password of the admin or creator of the app registrated.

- Service Principal: create a secret key to login.

For both of them, the API will have the same access as the account or Service Principal. If they are only added to a single workspace, then the API "get_workspaces" will only return ONE workspace.

The only way to effectively get everything is using the admin section of the API that would require special permissions. PowerBi Admin for the master users and a defined access to Admin API for the service principal inside a security group. Otherwise the API is restricted as the same permissions you have on the UI. Don't worry about API getting everywhere, it won't happen if they are not admins.

I hope that make sense

[ibarrau]

Hi. I'm not sure what the question is. I can just say that User.Read with Graph would be enough. You can pick the PowerBi Service permissions that you need to start using the API.

If you are using a secret, be sure the Tenant Settings under Admin Portal of PowerBi Service have the use of Service Principal Enabled.

I hope that helps,