Forum Discussion

Koteswara's avatar
Koteswara
New Member
1 year ago
Solved

Power BI workspace creation using API

Hi Team, I am using API (https:// api. powerbi. com/ v1.0/ myorg/ groups) to create a Power BI workspace using java code. For authenticationpurpose I am using Azure Service Principle.  I would like...
Need Help
  • Koteswara's avatar
    Koteswara
    1 year ago

    HI jaineshp 
    We have achieved the target.
    Please note that Power BI roles renamed to Fabric.
    https://powerbi.microsoft.com/en-us/blog/power-bi-administrator-role-will-be-renamed-to-fabric-administrator/
    Steps performed is
    1. Workload identity configuration in AKS cluster

    2. Assign Fabric Administrator role

     

    3. Tenant Setting Location

    The setting "Allow service principals to use Power BI APIs" is found at:

    • Power BI Admin Portal → Tenant settings → Developer settings
    • Look for "Allow service principals to use Power BI APIs"

    4. Add UAMI to capacity group in azure

    Thank you all..

jaineshp's avatar
jaineshp
Memorable Member
1 year ago

Hi Koteswara,

 

Yes, it’s possible to use User Assigned Managed Identity (UAMI) instead of a Service Principal when calling the Power BI REST API — especially in an AKS (Azure Kubernetes Service) environment. Below is a summary of what you need:

1. Required Roles for UAMI

Assign the following Azure AD and Power BI roles to the UAMI:

  • Azure AD App Role:

    • Assign Power BI Service Administrator or Power BI Admin API permission via Microsoft Graph/App Registrations.

  • Power BI Tenant Setting:

    • Ensure "Allow service principals to use Power BI APIs" is enabled under Admin Portal > Tenant Settings.

  • Workspace Access (optional):

    • For managing content inside the workspace, assign the UAMI as Admin to that workspace (if applicable).

2. Useful Documentation

Here’s the official documentation you’ll find useful:

3. Running in AKS

Since your code runs in AKS:

  • Ensure your AKS pod is configured with the UAMI using Azure AD Workload Identity or Azure AD Pod Identity (depending on your setup).

  • Use DefaultAzureCredential (Azure SDK) to authenticate via the managed identity.

Example (Java SDK):

TokenCredential credential = new DefaultAzureCredentialBuilder().build();

 

Let me know if you need a sample token acquisition flow or role assignment script.

—
Best regards,
Jainesh Poojara / Power BI Developer

    • Koteswara's avatar
      Koteswara
      New Member
      1 year ago

      Please note that useful documentation links are not opening. Please do needful

    • jaineshp's avatar
      jaineshp
      Memorable Member
      1 year ago

      Hi Koteswara,

      Yes, you're absolutely on the right track!

      Since you're already using a User Assigned Managed Identity (UAMI) for Azure Storage in your AKS cluster, integrating the same identity for accessing Power BI REST APIs is entirely possible — and the scope you're referring to is correct.

      Required Scope for Power BI REST API

      When authenticating using a Managed Identity, you should continue to use the following scope:

      https://analysis.windows.net/powerbi/api/.default

      This scope is consistent across all types of Azure AD identities (Service Principals, Managed Identities, etc.) when accessing the Power BI API.

      Summary of What You Need

      1. Correct Scope:

      2. Tenant Settings:

        • Make sure the Power BI tenant has enabled:

          • Admin Portal → Tenant Settings → "Allow service principals to use Power BI APIs" (must be enabled for your UAMI or its security group).

      3. Azure Role Assignments:

        • Assign your UAMI one of the following roles via Azure AD:

          • Power BI Service Administrator (for full control)

          • Or assign specific dataset/workspace access via Power BI workspace permissions (e.g., Admin, Member).

      4. AKS Workload Identity Setup:

        • Since workload identity is already working with Azure Storage, you can use the same mechanism.

        • Use DefaultAzureCredential from the Azure SDK (Java) to acquire tokens:


          TokenCredential credential = new DefaultAzureCredentialBuilder().build();

      5. Token Acquisition Example (Optional):
        If you're manually acquiring tokens via HTTP for debug/testing:

      Let me know if you need a working Java code snippet or role assignment script.

       

      Glad to help!

      Best regards,
      Jainesh Poojara
      Power BI Developer