Forum Discussion

DKHUghes55's avatar
DKHUghes55
Resolver I
8 months ago
Solved

Workspace Security

Hi Power BI Community, We have a need to occassionally identify what workspaces a user or security group has been granted access. Is there a way either through the Admin portal or through Power Bi ...
Need Help
  • Zanqueta's avatar
    Zanqueta
    8 months ago

    Hi DKHUghes55,

     

    Yes, it is possible to identify which workspaces a user or security group has access to, but this cannot be done directly in Power BI Desktop. There are two main approaches:

     

    Option 1 – Power BI Service Admin Portal

    If you have Power BI Admin permissions, you can:
    1. Access the Admin Portal.
    2. Navigate to Workspaces.
    3. Export the complete list of workspaces and their associated users or groups.
      • Use the Export to CSV feature for further analysis.
    Limitation: This is only available to tenant administrators.
     

    Option 2 – Power BI REST API

    For an automated and scalable solution:
    • Use the endpoint:
    • GET https://api.powerbi.com/v1.0/myorg/groups

     

    Combine the results to obtain a complete list of workspaces per user or group.

     

    Prerequisites:
    • Register an application in Azure Active Directory.
    • Grant permissions to the Power BI API.
    • Authenticate using OAuth2.
    Official Documentation:
     

    If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.

    Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.

     

  • v-venuppu's avatar
    v-venuppu
    8 months ago

    Hi DKHUghes55 ,

    Thank you for reaching out to Microsoft Fabric Community.

    Thank you Zanqueta for the prompt response.

    Yes, you can identify which workspaces a user or group has access to, but a few clarifications are important:
    The Admin Portal does not provide a direct export of users/groups per workspace or a list of workspaces for a specific user-you can only check access one workspace at a time.Power BI also doesn’t offer a single API that returns "workspaces for User X"; you need to list all workspaces and then check members for each.Tenant-wide results are only available if you are a Power BI Admin or a service principal with Admin permissions-otherwise the API shows only workspaces you can access.For admins, PowerShell is often the easiest option: Get-PowerBIWorkspace -All ,Get-PowerBIWorkspaceUser.API and PowerShell output will include users, security groups, M365 groups, and service principals.

anilgavhane's avatar
anilgavhane
Super User
8 months ago

DKHUghes55 

 

What works — and what you need

• Admin portal (UI)

  • If you are a tenant (or Fabric) admin, you can open the Admin portal → Workspaces tab. That gives you a list of all workspaces in the tenant. Microsoft Learn+1

  • For each workspace, you can click “Access” / workspace settings to see which users or groups have permission and what role (Admin/Member/Contributor/Viewer). Microsoft Fabric Community+2Bricks+2

  • This lets you manually inspect — but if you have many workspaces, manual checking may not scale well.

• REST API (programmatic)

If you want to script or automate the retrieval, you can use the official Power BI REST APIs:

This way you can build a full mapping: Workspace → users/groups → roles.

Limitations & What You Must Have

  • Only a “tenant/Fabric admin” or a service principal with appropriate admin consent + permissions (Tenant.Read.All or Tenant.ReadWrite.All) can call the admin APIs. Microsoft Learn+2Microsoft Learn+2

  • Merely being a “global admin” in Azure / M365 doesn’t guarantee you see all workspaces or their membership. Admin-level privileges must be explicitly enabled for Power BI admin APIs. Stack Overflow+2Stack Overflow+2

  • If you don’t have admin privileges, you’ll only see the workspaces you personally have access to. You cannot discover the permissions of workspaces to which you are not assigned. Microsoft Fabric Community+2Microsoft Fabric Community+2

One user on Reddit explained this trade-off succinctly:

“A list of all workspaces is available in the Admin portal. From there you can grant yourself or others access to the workspace itself.” Reddit+1

Another added:

“You need to use the admin resource if you want to get workspaces you haven't been explicitly assigned permissions to.” Reddit+1

What you can do now — recommended approach

If you have admin rights (or can get them), I recommend:

  1. Use Admin REST API GetGroupsAsAdmin to get all workspaces.

  2. For each workspace, use GetGroupUsersAsAdmin (or the $expand=users parameter) to pull its membership metadata.

  3. Consolidate the results (e.g. in a spreadsheet, JSON, or a database) to produce a “workspace-access matrix” — i.e. which users/groups have which role in which workspace.

If your organization prefers not to use API, you can alternatively use the Admin Portal UI — but that will be manual and tedious if you have many workspaces.

 

Note: AI helped me to format this response.