Forum Discussion
Question about Rest API's and Service Principals
Hi id013 ,
Thanks for reaching out to Microsoft Fabric Community.
Thanks tayloramy for the input.For additional context,
Power BI REST APIs allow service principals to work even when the permissions are listed as delegated, because Power BI supports service principal profiles. Once this is enabled in the tenant settings, the service principal acts like a virtual user, so the APIs can be called without an interactive sign-in.Microsoft Graph follows the standard OAuth model. Delegated permissions require a signed-in user context, and service principals using the client credentials flow don’t have one. For non-interactive use, Graph requires application permissions with admin consent in Azure AD.
Similar discussions and related documentation:
Service principal doesn't respect delegated permissions - Microsoft Q&A
Authentication and authorization basics - Microsoft Graph | Microsoft Learn
Hope this helps. Please reach out for further assistance.
Thank you.
Hi id013,
Which specific APIs/endpoints are you using? THe auth requirements vary depending on the specific endpoint.
I am able to do quite a lot with service principals and delegated/application permissions.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
So as far as the MS Graph goes, we basically just want to query the Azure Entra directory. The problem is granting application permissions to our Service Principal would allow (as I understand it) these permissions to be run across the entire tenancy. The issue with that is our tenancy is huge and supports quite a few business units, who may not appreciate our service principal having application access. The tenancy admin group is not keen on giving our service principal this much access either.
I thought b/c PBI rest api's let us use delegated permissions the same could be said for MS Graph APi's ... I guess not.
Hi id013,
Lots of the API endpoints require application permissions.
What specificlly are you trying to do?
The getUser endpoint allows for both application and delegated permissions:
http://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&source=recommendations&tabs=httpSo does the Get Group: https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http
If you can tell us what specific endpoint you are wanting to use, we can link you to the documentation.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Sorry I wasn't being clear, my issue wasn't that the API's wouldn't work with delegated permissions, it was that I wanted them to work without needing a login (which I understand is antithetical to delegated permissions) similar to how the Power BI Rest API's do but you've already explained why those work that way but Graph API's don't
