Forum Discussion
Question about Rest API's and Service Principals
Hi id013 ,
Thanks for reaching out to Microsoft Fabric Community.
Thanks tayloramy for the input.For additional context,
Power BI REST APIs allow service principals to work even when the permissions are listed as delegated, because Power BI supports service principal profiles. Once this is enabled in the tenant settings, the service principal acts like a virtual user, so the APIs can be called without an interactive sign-in.Microsoft Graph follows the standard OAuth model. Delegated permissions require a signed-in user context, and service principals using the client credentials flow don’t have one. For non-interactive use, Graph requires application permissions with admin consent in Azure AD.
Similar discussions and related documentation:
Service principal doesn't respect delegated permissions - Microsoft Q&A
Authentication and authorization basics - Microsoft Graph | Microsoft Learn
Hope this helps. Please reach out for further assistance.
Thank you.
Hi id013,
Lots of the API endpoints require application permissions.
What specificlly are you trying to do?
The getUser endpoint allows for both application and delegated permissions:
http://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&source=recommendations&tabs=http
So does the Get Group: https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http
If you can tell us what specific endpoint you are wanting to use, we can link you to the documentation.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Sorry I wasn't being clear, my issue wasn't that the API's wouldn't work with delegated permissions, it was that I wanted them to work without needing a login (which I understand is antithetical to delegated permissions) similar to how the Power BI Rest API's do but you've already explained why those work that way but Graph API's don't