Service Principal Permissions for Viewing All Reports in Fabric Workspaces

[Rodrigo65789]

Hello,

I am working with the Fabric API ( link ) , which requires Workspace.Read.All or Workspace.ReadWrite.All delegated permissions and the “viewer” role in the workspace.

I have the following questions about permissions and access using a Service Principal:

• Is it strictly necessary to add the Service Principal as a member of every workspace in order for it to access and view reports, semantic models, and other objects?
• Is there any way to grant global permissions to the Service Principal so it can view all reports and objects across all workspaces in the organization, without manually adding it to each workspace one by one?

I’d appreciate any clarification about best practices for managing access with Service Principals, or if there are any alternatives for centralized permissions in the context of Microsoft Entra and Fabric.

Thank you!

[Rodrigo65789]

Thank you very much! I hadn't seen that documentation before, and now I'm able to get reports, dashboards, datasets, and dataflows.

Just one last question: do you know if it’s possible to obtain datamarts? Also, why do I need to use the Fabric API to list workspaces and not the Power BI API?

Thanks again!

[tayloramy]

Hi @Rodrigo65789, 

Datamarts were retired last month. 

Introduction to datamarts - Power BI | Microsoft Learn

If you still have datamarts, convert them to warehouses ASAP or they will be deleted. 

How to upgrade a Power BI Datamart to a Warehouse - Microsoft Fabric | Microsoft Learn

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[ibarrau]

Hi. Adding a Service Principal to a workspace let the service principal to use the Core or specific requests for each category. However, if you want to read the whole tenant, you need to use the Admin API. In order to let a service principal use that, you should allow it in Fabric Admin portal:

With admin api you can read all items. If you are just working with Power Bi, take a look at Power Bi Rest API for more admin requests.

I hope that helps,

[Rodrigo65789]

Hi,

Thank you for your response!

I had already created a security group in Entra ID and added the Service Principal to it. With this configuration, I can successfully list workspaces using the Admin API without any issues.

However, when I try to query reports, I am getting a 401 Unauthorized error.

Is there anything else I need to configure so the Service Principal can read reports (and other objects) as well? Any explanation why it works for workspaces but not for reports?

Thanks in advance 🙂

[ibarrau]

The configuration means you can use all Admin requests to query the whole tenant. You can use the Fabric API or the Power Bi one: https://learn.microsoft.com/en-us/rest/api/power-bi/admin

Like I said before, the individual categories like reports, datasets, gateways are endpoints that will require the specific permission like being part of the workspace.

Regards,

[tayloramy · Accepted solution]

Hi @Rodrigo65789, 

What endpoint are you using to query reports? You should be able to use the GetReportsAsAdmin endpoint with your current setup: 
Admin - Reports GetReportsAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn

If you want to use the non admin APIs like exporting the report, then the service principal needs access to the workspace. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[Rodrigo65789]

Thank you very much! I hadn't seen that documentation before, and now I'm able to get reports, dashboards, datasets, and dataflows.

Just one last question: do you know if it’s possible to obtain datamarts? Also, why do I need to use the Fabric API to list workspaces and not the Power BI API?

Thanks again!

[ibarrau]

Sadly there is no request for datamart at power bi rest api. You should use the Fabric one "list items" endpoint with a URI parameter for type=Datamart

You don't need to use the Fabric API if you don't want. You only need to use it if you can't do it in the power bi one, like listing datamarts. If you want the workspaces using the power bi one you can use this endpoint: https://learn.microsoft.com/en-us/rest/api/power-bi/admin/groups-get-groups-as-admin

I like a lot that endpoint because it let you expand by type of item.

Regards