Power BI workspace creation using API

[Koteswara]

Hi Team,
I am using API (https:// api. powerbi. com/ v1.0/ myorg/ groups) to create a Power BI workspace using java code. For authenticationpurpose I am using Azure Service Principle. 
I would like to use User Assigned Managed Identity instead of SP. My code is running in AKS cluster.
Please give me documentation list if any.
What roles we have to assign to User Assigned Managed Identity.

[Koteswara]

Look like Power Bi roles renamed to Fabric.
https://powerbi.microsoft.com/en-us/blog/power-bi-administrator-role-will-be-renamed-to-fabric-admin...

[Poojara_D12]

Hi @Koteswara 

When you want to switch from using a Service Principal (SP) to a User Assigned Managed Identity (UAMI) for creating a Power BI workspace via the Power BI REST API (https://api.powerbi.com/v1.0/myorg/groups) from your Java code running in Azure Kubernetes Service (AKS), the key change is in how you authenticate. Managed identities allow your AKS workloads to obtain Azure AD tokens without storing credentials. You will need to enable Managed Identity for your AKS workload (using Azure AD workload identity or aad-pod-identity) and configure your Java code to acquire an access token from Azure Instance Metadata Service (IMDS) for the Power BI resource (https://analysis.windows.net/powerbi/api). After obtaining the token, you use it as a Bearer token in your REST API calls just like before. The User Assigned Managed Identity must be: (1) granted Power BI Admin or Contributor permissions on the target Power BI tenant through the Microsoft 365 Admin Center (or via Power BI Admin portal, enabling Service Principal access for this identity), and (2) have the Azure role assignment (Reader or Contributor) only if you are managing Azure resources—but for Power BI REST API, the critical step is to allow the identity in the Power BI Admin portal under "Tenant settings → Developer settings → Allow service principals to use Power BI APIs" and optionally assign it to specific security groups. In summary, after assigning the UAMI to AKS, enabling workload identity, and granting API access in the Power BI Admin portal, your Java code can seamlessly authenticate with MSI instead of storing client secrets.

[v-dineshya]

Hi @Koteswara ,

Thank you for reaching out to the Microsoft Community Forum.

Hi @jaineshp , @rohit1991 , Thank you for your prompt response.

Hi @Koteswara , Could you please try the proposed solution shared by @jaineshp , @rohit1991 .  Please do let us know if you have any further queries.

Regards,

Dinesh

[Koteswara]

Hi @jaineshp , @rohit1991 , @Poojara_D12  and @v-dineshya 
Thanks for your assistance.
Allow me for some time. I will check and confirm you here.
Thanks.

[Koteswara]

Hi Team,
I got reply form my IT team saying they did not find respective role.
Please help me

[jaineshp]

Hey @Koteswara,

Let me clarify the same.

1. Power BI Service Administrator Role

This is not an Azure AD role but a Power BI-specific admin role. Your IT team needs to:

• Go to Microsoft 365 Admin Center → Roles → Role assignments
• Look for Power BI Administrator (not "Power BI Service Administrator")
• Or assign Global Administrator which includes Power BI admin rights

2. Tenant Setting Location

The setting "Allow service principals to use Power BI APIs" is found at:

• Power BI Admin Portal → Tenant settings → Developer settings
• Look for "Allow service principals to use Power BI APIs"
• This must be enabled and the UAMI should be added to the security group allowed to use this setting

3. Alternative Approach - API Permissions

Instead of Power BI admin role, you can assign Microsoft Graph API permissions to the UAMI:

Required API Permissions:

• Tenant.Read.All (for reading tenant info)
• Dataset.ReadWrite.All (for dataset operations)
• Dashboard.ReadWrite.All (for dashboard operations)
• Report.ReadWrite.All (for report operations)
  

Did it work? ✔ Give a Kudo • Mark as Solution – help others too!

Best regards,
Jainesh Poojara / Power BI Developer

[Koteswara · Accepted solution]

HI @jaineshp 
We have achieved the target.
Please note that Power BI roles renamed to Fabric.
https://powerbi.microsoft.com/en-us/blog/power-bi-administrator-role-will-be-renamed-to-fabric-admin...
Steps performed is
1. Workload identity configuration in AKS cluster

2. Assign Fabric Administrator role

3. Tenant Setting Location

The setting "Allow service principals to use Power BI APIs" is found at:

• Power BI Admin Portal → Tenant settings → Developer settings
• Look for "Allow service principals to use Power BI APIs"

4. Add UAMI to capacity group in azure

Thank you all..

[jaineshp]

Hey @Koteswara,

Sounds great!

Mark as Solution – help others too!

Best Regards,
Jainesh Poojara | Power BI Developer

[Koteswara]

Hi @jaineshp 
Alternative Approach that you provided using Graph API permission,
if i'm correct are you looking for the Azure - app registration service  with Microsoft Graph  api access ?

Our UAMI will not display in this app registration list right

[jaineshp]

Hey @Koteswara,

You're absolutely correct!

User-Assigned Managed Identities (UAMI) do NOT appear in App Registrations - this is a key distinction that many people get confused about.

Here's the clarification:

UAMI vs App Registration

• UAMI = Azure resource, appears in Azure Portal → Managed Identities
• App Registration = Azure AD application, appears in Azure Portal → App Registrations

For Power BI API Access with UAMI, you have 2 options:

Option 1: Power BI Admin Portal (Recommended)

• Enable "Allow service principals to use Power BI APIs" in Power BI Admin Portal
• Add your UAMI to the security group that's allowed to use this setting
• This is the native Power BI way and doesn't require Graph API permissions

Option 2: If you need Graph API approach

You would need to:

1. Create an App Registration (separate from UAMI)
2. Grant Microsoft Graph API permissions to this App Registration
3. Use client credentials flow with this App Registration

Bottom Line

For your UAMI to work with Power BI APIs, stick with Option 1 - the Power BI Admin Portal tenant setting.

The Graph API permissions I mentioned earlier would only apply if you were using an App Registration instead of a UAMI.

Thanks for catching that important distinction! 👍

Did it work? ✔ Give a Kudo • Mark as Solution – help others too!

Best regards,
Jainesh Poojara / Power BI Developer

[v-dineshya]

Hi @jaineshp Thank you for your prompt response.

Hi @Koteswara , In addition to @jaineshp  response, I am adding Microsoft official document.

Use a managed identity in Azure Kubernetes Service (AKS) - Azure Kubernetes Service | Microsoft Lear...

Please do let us know if you have any further queries.

Regards,

Dinesh

[rohit1991]

Hi @Koteswara ,

Using a User Assigned Managed Identity (UAMI) is fully supported for calling the Power BI REST API from AKS. Here’s the streamlined approach:

1. Scope: Stick with https://analysis.windows.net/powerbi/api/.default as your scope when acquiring tokens for Power BI REST API. This is the same as with a Service Principal.

2. Permissions/Roles: Assign your UAMI either the Power BI Service Admin role (for full API control) or just Admin/Member rights on specific workspaces, depending on what your automation needs. In Power BI Admin Portal, make sure “Allow service principals to use Power BI APIs” is enabled—this is required for managed identities too.

3. AKS Setup: If your AKS pod is already using the UAMI for Azure Storage, you’re set. In your Java code, use the Azure SDK’s DefaultAzureCredential to authenticate—no secrets or SP credentials needed.

You don’t have to change your scope or approach when switching from SP to Managed Identity. As long as the right roles are in place and workload identity is configured, UAMI works great for Power BI API automation in AKS.

[jaineshp]

Hi @Koteswara,

Yes, it’s possible to use User Assigned Managed Identity (UAMI) instead of a Service Principal when calling the Power BI REST API — especially in an AKS (Azure Kubernetes Service) environment. Below is a summary of what you need:

---

1. Required Roles for UAMI

Assign the following Azure AD and Power BI roles to the UAMI:

• Azure AD App Role:

  • Assign Power BI Service Administrator or Power BI Admin API permission via Microsoft Graph/App Registrations.

• Power BI Tenant Setting:

  • Ensure "Allow service principals to use Power BI APIs" is enabled under Admin Portal > Tenant Settings.

• Workspace Access (optional):

  • For managing content inside the workspace, assign the UAMI as Admin to that workspace (if applicable).

---

2. Useful Documentation

Here’s the official documentation you’ll find useful:

• Use Managed Identity with Power BI REST API (Microsoft Docs)

• Power BI REST API Authentication Overview

• Assign Roles to Managed Identity (Microsoft Entra ID)

---

3. Running in AKS

Since your code runs in AKS:

• Ensure your AKS pod is configured with the UAMI using Azure AD Workload Identity or Azure AD Pod Identity (depending on your setup).

• Use DefaultAzureCredential (Azure SDK) to authenticate via the managed identity.

Example (Java SDK):

TokenCredential credential = new DefaultAzureCredentialBuilder().build();

Let me know if you need a sample token acquisition flow or role assignment script.

—
Best regards,
Jainesh Poojara / Power BI Developer

[Koteswara]

Hi Jainesh Poojara,

Thanks for your reply.
Yes. Workload identity configured to in AKS cluster. I am using UAMI already for azure storage APIs.

For Azure storage I am passing scope as https://storage.azure.com/.default

What value we should pass here? Will it accept my old one (Which I am using with SP)  https://analysis.windows.net/powerbi/api/.default ?

[jaineshp]

Hi @Koteswara,

Yes, you're absolutely on the right track!

Since you're already using a User Assigned Managed Identity (UAMI) for Azure Storage in your AKS cluster, integrating the same identity for accessing Power BI REST APIs is entirely possible — and the scope you're referring to is correct.

Required Scope for Power BI REST API

When authenticating using a Managed Identity, you should continue to use the following scope:

https://analysis.windows.net/powerbi/api/.default

This scope is consistent across all types of Azure AD identities (Service Principals, Managed Identities, etc.) when accessing the Power BI API.

Summary of What You Need

1. Correct Scope:

   • https://analysis.windows.net/powerbi/api/.default
     
     

2. Tenant Settings:

   • Make sure the Power BI tenant has enabled:

     • Admin Portal → Tenant Settings → "Allow service principals to use Power BI APIs" (must be enabled for your UAMI or its security group).

3. Azure Role Assignments:

   • Assign your UAMI one of the following roles via Azure AD:

     • Power BI Service Administrator (for full control)

     • Or assign specific dataset/workspace access via Power BI workspace permissions (e.g., Admin, Member).

4. AKS Workload Identity Setup:

   • Since workload identity is already working with Azure Storage, you can use the same mechanism.

   • Use DefaultAzureCredential from the Azure SDK (Java) to acquire tokens:

     
     TokenCredential credential = new DefaultAzureCredentialBuilder().build();

5. Token Acquisition Example (Optional):
   If you're manually acquiring tokens via HTTP for debug/testing:

   • Make a request to:
     
     http://169.254.169.254/metadata/identity/oauth2/token
     
     

   • With query parameters:
     
     

     resource=https://analysis.windows.net/powerbi/api
     &api-version=2018-02-01

   • Add Header:

     
     Metadata: true

Let me know if you need a working Java code snippet or role assignment script.

Glad to help!

Best regards,
Jainesh Poojara
Power BI Developer

[Koteswara]

Please note that useful documentation links are not opening. Please do needful

[jaineshp]

Useful Documentation

Here’s the official documentation you’ll find useful:

Use Managed Identity to authenticate your Azure Stream Analytics job to Power BI

Power BI REST APIs for embedded analytics and automation - Learn Microsoft

Assign Azure roles to a managed identity (Preview) - Learn Microsoft