Request to Enable Power BI Service Application Permissions for Service Principal Integration

Question

Dear Support Team,

I am currently working on an integration that requires embedding Power BI reports using a service principal (application authentication, without a signed-in user). To achieve this, I need to assign the following permissions to my Azure AD application under the Power BI Service API:

• Dataset.Read.All
• Report.Read.All
• Workspace.Read.All

However, when I attempt to add these permissions in the Azure portal, I can only find them under Delegated permissions. They do not appear as available options under Application permissions, which are required for service-to-service authentication scenarios.

Could you please assist in making these permissions available as Application permissions? Alternatively, if there are tenant-level restrictions or prerequisites preventing these permissions from being displayed, please provide guidance on how to resolve this so that my service principal can access Power BI resources as intended.

Additional Details:

• Our use case specifically requires Application permissions, as this integration will run as a background service without user interaction.
• I have already confirmed that I am selecting the correct API (“Power BI Service”) and the appropriate tenant.
• The lack of these permissions in Application mode is currently blocking our project.

Thank you for your assistance. Please let me know if you need any further information.

Answer 1

Hello Contac Contabilidade,

I understand you’re trying to embed Power BI reports using a service principal, but the required permissions (Dataset.Read.All, Report.Read.All, Workspace.Read.All) are only available under Delegated permissions.

These permissions are designed for user-based access and cannot be used for service principal authentication. In service principal authentication, access is managed through Power BI Admin Portal settings and workspace roles.

You can follow these steps to set up service principal access:

Initially, register one Microsoft Entra application and create one client secret in it:

Then, create a security group in Microsoft Entra ID and add service principal to the group to grant access to Power BI content:

Now, enable below settings in the Power BI Admin Portal by selecting the security group:

Embed content in apps:

Service principals can call Fabric public APIs:

After configuration, add the service principal to the Power BI workspace with Admin or Member role:

Now, authenticate using client credentials (client ID and client secret) to obtain an access token from Microsoft Entra ID.

Once authenticated, your service principal can query Power BI data like reports using the Power BI API.

GET https://api.powerbi.com/v1.0/myorg/groups/{groupid}/reports/{reportid}/

For more details, you can refer to this guide: Embed Power BI content with service principal

Hope this helps!

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.