Forum Discussion
Question about Rest API's and Service Principals
Hi id013 ,
Thanks for reaching out to Microsoft Fabric Community.
Thanks tayloramy for the input.For additional context,
Power BI REST APIs allow service principals to work even when the permissions are listed as delegated, because Power BI supports service principal profiles. Once this is enabled in the tenant settings, the service principal acts like a virtual user, so the APIs can be called without an interactive sign-in.Microsoft Graph follows the standard OAuth model. Delegated permissions require a signed-in user context, and service principals using the client credentials flow don’t have one. For non-interactive use, Graph requires application permissions with admin consent in Azure AD.
Similar discussions and related documentation:
Service principal doesn't respect delegated permissions - Microsoft Q&A
Authentication and authorization basics - Microsoft Graph | Microsoft Learn
Hope this helps. Please reach out for further assistance.
Thank you.
So as far as the MS Graph goes, we basically just want to query the Azure Entra directory. The problem is granting application permissions to our Service Principal would allow (as I understand it) these permissions to be run across the entire tenancy. The issue with that is our tenancy is huge and supports quite a few business units, who may not appreciate our service principal having application access. The tenancy admin group is not keen on giving our service principal this much access either.
I thought b/c PBI rest api's let us use delegated permissions the same could be said for MS Graph APi's ... I guess not.