Steps required to use Power BI API with a Service Princpal - Doubts

[alfBI]

Good morning guys,

Which is the difference between granting Power BI API permissions to a service principal in Entra ID

and enable usage of Fabric APIs (I assume that Power BI APIs are also included here) on Power BI Admin Portal (tenant settings)

E.g: Which is the action required to allow a Service Principal to refresh a datamodel using Power BI Rest API? Both? 

What happens with the rights on the Workspace. If API rights mention -All-, does this mean access to all datasets on all workspaces or additional rights has to be provided to SP on the corresponding workspace?

Thanks

[v-prasare]

@alfBI, As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for your issue worked? or let us know if you need any further assistance here?

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[v-prasare]

@alfBI, 

No, Dataset.Read.All or Dataset.ReadWrite.All does NOT automatically grant access to all workspaces. It only gives API-level permission to perform actions on datasets where the Service Principal already has access.

• Dataset.Read.All → Grants API permission to view datasets but does not override workspace security.
• Dataset.ReadWrite.All → Grants API permission to modify (refresh) datasets but does not override workspace security.
• You must still manually assign the Service Principal to the relevant Power BI workspaces.

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[alfBI]

OK, but then I need to grant the SP a API Permission on entra ID and that´s enough, or we need also to grant SP access to Fabric APIs on Power BI Admin (Tenant settings)?  I don't see the difference between these 2 actions

[v-prasare · Accepted solution]

@alfBI, Sorry for the delayed repsonse here.

To allow a Service Principal (SP) to refresh a dataset using the Power BI REST API, both actions are required:

• Grant API permissions in Entra ID – Assign the necessary API permissions (such as Dataset.ReadWrite.All) to the SP in Entra ID.
• Enable Service Principal access in Power BI Admin (Tenant Settings) – Under "Admin API settings" in Power BI Admin Portal, allow service principals to use Power BI APIs.

Regarding workspace access:

• Dataset.ReadWrite.All  in API permissions grants access to all datasets, but it does not override workspace-level permissions. The SP must still be assigned the necessary role (Admin, Member, or Contributor) in each workspace where it needs to refresh datasets.

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query