Forum Discussion

alfBI's avatar
alfBI
Icon for Responsive Resident rankResponsive Resident
1 year ago
Solved

Steps required to use Power BI API with a Service Princpal - Doubts

Good morning guys,   Which is the difference between granting Power BI API permissions to a service principal in Entra ID     and enable usage of Fabric APIs (I assume that Power BI APIs a...
Need Help
  • v-prasare's avatar
    v-prasare
    1 year ago

    alfBI, Sorry for the delayed repsonse here.

     

    To allow a Service Principal (SP) to refresh a dataset using the Power BI REST API, both actions are required:

    • Grant API permissions in Entra ID – Assign the necessary API permissions (such as Dataset.ReadWrite.All) to the SP in Entra ID.
    • Enable Service Principal access in Power BI Admin (Tenant Settings) – Under "Admin API settings" in Power BI Admin Portal, allow service principals to use Power BI APIs.

    Regarding workspace access:

    • Dataset.ReadWrite.All  in API permissions grants access to all datasets, but it does not override workspace-level permissions. The SP must still be assigned the necessary role (Admin, Member, or Contributor) in each workspace where it needs to refresh datasets.

     

     

    Thanks,

    Prashanth Are

    MS Fabric community support

     

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

     

v-prasare's avatar
v-prasare
Icon for Community Support rankCommunity Support
1 year ago

alfBI, 

No, Dataset.Read.All or Dataset.ReadWrite.All does NOT automatically grant access to all workspaces. It only gives API-level permission to perform actions on datasets where the Service Principal already has access.

 

 

  • Dataset.Read.All → Grants API permission to view datasets but does not override workspace security.
  • Dataset.ReadWrite.All → Grants API permission to modify (refresh) datasets but does not override workspace security.
  • You must still manually assign the Service Principal to the relevant Power BI workspaces.

 

 

Thanks,

Prashanth Are

MS Fabric community support

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

 

 

 

  • alfBI's avatar
    alfBI
    Icon for Responsive Resident rankResponsive Resident
    1 year ago

    OK, but then I need to grant the SP a API Permission on entra ID and that´s enough, or we need also to grant SP access to Fabric APIs on Power BI Admin (Tenant settings)?  I don't see the difference between these 2 actions

    • v-prasare's avatar
      v-prasare
      Icon for Community Support rankCommunity Support
      1 year ago

      alfBI, Sorry for the delayed repsonse here.

       

      To allow a Service Principal (SP) to refresh a dataset using the Power BI REST API, both actions are required:

      • Grant API permissions in Entra ID – Assign the necessary API permissions (such as Dataset.ReadWrite.All) to the SP in Entra ID.
      • Enable Service Principal access in Power BI Admin (Tenant Settings) – Under "Admin API settings" in Power BI Admin Portal, allow service principals to use Power BI APIs.

      Regarding workspace access:

      • Dataset.ReadWrite.All  in API permissions grants access to all datasets, but it does not override workspace-level permissions. The SP must still be assigned the necessary role (Admin, Member, or Contributor) in each workspace where it needs to refresh datasets.

       

       

      Thanks,

      Prashanth Are

      MS Fabric community support

       

      If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query