Power BI Tenant Level REST API access

[simsta]

Hello there,

In my application I want to implement an automated Power BI Refresh via Rest API. Due to the tenant settings it is only possible to select "Read / Write all" when allowing API access on tenant level (see image below).

My questions are:

1. How does Power BI handle access permissions on workspaces, datasets and reports? Is it handled via common permissions on workspaces etc.?

2. When I have access to the Power BI, can I see or list all reports within the whole tenant or am I prevented of doing that?

Thanks a lot

Simon

[mariussve1]

1. Yes, I have created a security group and putted my app user in this group. Then I gave this security group admin access to all the workspaces.

2. Yes, you have admin api's that give access across your whole tenant. In tenant admin settings in PowerBI you can Grant access to the security group in admin api's.

Br

Marius

[simsta]

@Greg_Deckler  Considering the first question, what about the API permissions when the setting API Access is enabled on tenent-level? Are the permissions according to what workspace access I have, in other words can I access and list datasets which I have no access in PowerBI Service over the API?

[Greg_Deckler]

@simsta If you have the Fabric Admin role then yes, otherwise, no.

[Greg_Deckler · Accepted solution]

@simsta You can set workspace level permissions via Admin, Member or Contributor roles and that gives you access to every item of content in that workspace. Viewer allows read access to every item in the workspace. Or you can set individual permissions on specific items within the workspace. If you have the Fabric Admin role within Azure AD, you have access to everything and can use the REST API to list out every workspace and items within those workspaces