How to limit workspace access for a service principal.

[xhan]

Hi friends,

We are using a service principal to pull metadata of workspaces. There are workspaces that we don't want to give access to this service principal. But even we don't give the access the service principal at the workspace access level:

The service principal is still have to get access to this workspace.

Is there a way to limit the access?

We did give access to the security group (the service principal belongs to) admin read only access through tenent settings. Thanks a lot!

[Daryl-Lynch-Bzy]

Hi @xhan - I am trying to understand which type of Service Principal you are using to capture Metadata.  If you follow this type: Enable service principal authentication for read-only admin APIs - Power BI | Microsoft Learn

the Service Principal will have access to all Metadata for all workspaces, but no access to any data within those workspaces.   So, in your case, when you extract Metadata you can provide a list of Workspaces that are required (or exclude restricted workspaces).  This Service Principal can only use the Admin APIs.

Another option is to set up a Service Account (not quite a principal).  This account is normal account, so it needs to be a licenced Power BI user and assigned to required workspaces with Admin/Member/Contributor access.  This Service Account can only use regular APIs (not Admin APIs) on the objects its granted access to use.  It will also have access to data.

There is another option that sit between these.  However, I personally feel this should only be used for Embedding Power BI in your Web Apps.  Embed Power BI content in an embedded analytics application with service principal and an applicatio...

[xhan]

thanks a lot @Daryl-Lynch-Bzy ! The last one for embedding Power BI, that one's also for creating a service principal. The only difference is that it enabled `Embedding content in Apps` for the service principal. And add admin in the workspace for the power BI service principal. Please let me know if I'm understanding anything wrong.

Thanks a lot