Admin - Rotate Power BI Encryption Key

Rotate the encryption key for Power BI workspaces assigned to a capacity.

Permissions

The user must be a Fabric administrator.

Required Scope

Tenant.Read.All or Tenant.ReadWrite.All

Limitations

Maximum 600 requests per hour.

POST https://api.powerbi.com/v1.0/myorg/admin/tenantKeys/{tenantKeyId}/Default.Rotate

URI Parameters

Name In Required Type Description
tenantKeyId
path True

string

uuid

The tenant key ID

Request Body

Name Type Description
keyVaultKeyIdentifier

string

The URI that uniquely specifies the encryption key in Azure Key Vault

Responses

Name Type Description
200 OK

TenantKey

OK

Examples

Example

Sample request

POST https://api.powerbi.com/v1.0/myorg/admin/tenantKeys/82d9a37a-2b45-4221-b012-cb109b8e30c7/Default.Rotate
{
  "keyVaultKeyIdentifier": "https://contoso-vault2.vault.azure.net/keys/ContosoKeyVault/b2ab4ba1c7b341eea5ecaaa2wb54c4d2"
}

Sample response

{
  "id": "82d9a37a-2b45-4221-b012-cb109b8e30c7",
  "name": "Contoso Sales",
  "keyVaultKeyIdentifier": "https://contoso-vault2.vault.azure.net/keys/ContosoKeyVault/b2ab4ba1c7b341eea5ecaaa2wb54c4d2",
  "isDefault": true,
  "createdAt": "2019-04-30T21:35:15.867-07:00",
  "updatedAt": "2019-04-30T21:35:15.867-07:00"
}

Definitions

Name Description
TenantKey

Encryption key information

TenantKeyRotationRequest

A request to rotate an encryption key

TenantKey

Encryption key information

Name Type Description
createdAt

string

The creation date and time of the encryption key

id

string

The ID of the encryption key

isDefault

boolean

Whether the encryption key is the default key for the entire tenant. Any newly created capacity inherits the default key.

keyVaultKeyIdentifier

string

The URI that uniquely specifies the encryption key in Azure Key Vault

name

string

The name of the encryption key

updatedAt

string

The last update date and time of the encryption key

TenantKeyRotationRequest

A request to rotate an encryption key

Name Type Description
keyVaultKeyIdentifier

string

The URI that uniquely specifies the encryption key in Azure Key Vault