Power BI workspace creation using API

Hi Koteswara,

Yes, it’s possible to use User Assigned Managed Identity (UAMI) instead of a Service Principal when calling the Power BI REST API — especially in an AKS (Azure Kubernetes Service) environment. Below is a summary of what you need:

1. Required Roles for UAMI

Assign the following Azure AD and Power BI roles to the UAMI:

• Azure AD App Role:

  • Assign Power BI Service Administrator or Power BI Admin API permission via Microsoft Graph/App Registrations.

• Power BI Tenant Setting:

  • Ensure "Allow service principals to use Power BI APIs" is enabled under Admin Portal > Tenant Settings.

• Workspace Access (optional):

  • For managing content inside the workspace, assign the UAMI as Admin to that workspace (if applicable).

2. Useful Documentation

Here’s the official documentation you’ll find useful:

• Use Managed Identity with Power BI REST API (Microsoft Docs)

• Power BI REST API Authentication Overview

• Assign Roles to Managed Identity (Microsoft Entra ID)

3. Running in AKS

Since your code runs in AKS:

• Ensure your AKS pod is configured with the UAMI using Azure AD Workload Identity or Azure AD Pod Identity (depending on your setup).

• Use DefaultAzureCredential (Azure SDK) to authenticate via the managed identity.

Example (Java SDK):

TokenCredential credential = new DefaultAzureCredentialBuilder().build();

Let me know if you need a sample token acquisition flow or role assignment script.

—
Best regards,
Jainesh Poojara / Power BI Developer

Look like Power Bi roles renamed to Fabric.
https://powerbi.microsoft.com/en-us/blog/power-bi-administrator-role-will-be-renamed-to-fabric-administrator/

Hi Koteswara ,

Using a User Assigned Managed Identity (UAMI) is fully supported for calling the Power BI REST API from AKS. Here’s the streamlined approach:

1. Scope: Stick with https://analysis.windows.net/powerbi/api/.default as your scope when acquiring tokens for Power BI REST API. This is the same as with a Service Principal.

2. Permissions/Roles: Assign your UAMI either the Power BI Service Admin role (for full API control) or just Admin/Member rights on specific workspaces, depending on what your automation needs. In Power BI Admin Portal, make sure “Allow service principals to use Power BI APIs” is enabled—this is required for managed identities too.

3. AKS Setup: If your AKS pod is already using the UAMI for Azure Storage, you’re set. In your Java code, use the Azure SDK’s DefaultAzureCredential to authenticate—no secrets or SP credentials needed.

You don’t have to change your scope or approach when switching from SP to Managed Identity. As long as the right roles are in place and workload identity is configured, UAMI works great for Power BI API automation in AKS.

Hi Koteswara ,

Thank you for reaching out to the Microsoft Community Forum.

Hi jaineshp , rohit1991 , Thank you for your prompt response.

Hi Koteswara , Could you please try the proposed solution shared by jaineshp , rohit1991 .  Please do let us know if you have any further queries.

Regards,

Dinesh

Hi Koteswara 

When you want to switch from using a Service Principal (SP) to a User Assigned Managed Identity (UAMI) for creating a Power BI workspace via the Power BI REST API (https://api.powerbi.com/v1.0/myorg/groups) from your Java code running in Azure Kubernetes Service (AKS), the key change is in how you authenticate. Managed identities allow your AKS workloads to obtain Azure AD tokens without storing credentials. You will need to enable Managed Identity for your AKS workload (using Azure AD workload identity or aad-pod-identity) and configure your Java code to acquire an access token from Azure Instance Metadata Service (IMDS) for the Power BI resource (https://analysis.windows.net/powerbi/api). After obtaining the token, you use it as a Bearer token in your REST API calls just like before. The User Assigned Managed Identity must be: (1) granted Power BI Admin or Contributor permissions on the target Power BI tenant through the Microsoft 365 Admin Center (or via Power BI Admin portal, enabling Service Principal access for this identity), and (2) have the Azure role assignment (Reader or Contributor) only if you are managing Azure resources—but for Power BI REST API, the critical step is to allow the identity in the Power BI Admin portal under "Tenant settings → Developer settings → Allow service principals to use Power BI APIs" and optionally assign it to specific security groups. In summary, after assigning the UAMI to AKS, enabling workload identity, and granting API access in the Power BI Admin portal, your Java code can seamlessly authenticate with MSI instead of storing client secrets.