Skip to main content

Authentication Service Principal

Administrator

When users log in to DataCentral using their Microsoft credentials, DataCentral authenticates them through an Entra ID App Registration. DataCentral supports three authentication levels, each granting a different set of permissions depending on what capabilities are needed.

Authentication Levels​

PermissionAuth Only+ Power BI+ Security Groups
User.Read✓✓✓
App.Read.All✓✓
Dashboard.Read.All✓✓
Dataset.Read.All✓✓
Report.Read.All✓✓
Workspace.Read.All✓✓
Group.Read.All✓
Group.Member.ReadWrite.All✓
  • Authentication Only — Minimal permissions for identity verification. Requires a separate Power BI Service Principal for report embedding.
  • Authentication + Power BI — Users can embed reports using their own Power BI Pro licenses without a separate Power BI Service Principal.
  • Authentication + Power BI + Security Groups — Grants the authenticated user delegated permissions to manage Entra ID security group membership. This level is not recommended — use the dedicated Security Group Sync Service Principal instead, which handles group management via its own identity and requires no elevated permissions on the logged-in user.

1. Register an Application in Entra ID​

Repeat this process for each authentication level you want to configure (up to three app registrations).

  1. Log in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click New registration.
  4. Provide a name (e.g., DataCentral Auth).
  5. Under Supported account types, select Accounts in any organizational directory (Multitenant).
  6. Under Redirect URI, select Single-page application (SPA) and enter the redirect URI provided by DataCentral.
  7. Click Register.
  8. Copy the Application (client) ID from the Overview tab.

You can add additional redirect URIs later under Authentication if needed.

2. Configure API Permissions​

  1. In the App Registration, go to API permissions.
  2. Click Add a permission > Microsoft Graph > Delegated permissions.
  3. Add the permissions for your chosen authentication level (see the table above).
  4. Click Grant admin consent for your organisation.

3. Configure DataCentral​

Authentication Service Principal configuration is done at the host instance level, not per-tenant.

  1. In the host instance, navigate to Administration > Settings > Azure Configurations.
  2. Enter the Application (client) ID for each authentication level you have configured.
  3. Click Save.

Individual tenants can then select which authentication level applies to their users under Administration > Settings > Security.