Skip to main content

Power BI Service Principal

Administrator

A Power BI Service Principal is the tenant-side identity associated with an application in Microsoft Entra ID (Azure AD). It allows DataCentral to authenticate and interact with the Power BI Service programmatically, without requiring a user's personal credentials.

This is required for "App Owns Data" embedding — it enables DataCentral to display reports to users who do not have their own Power BI Pro licenses (such as User Pass or Mobile ID users).

Required Azure Roles​

To register an application in Entra ID, your account must have one of the following roles:

  • Application Administrator
  • Cloud Application Administrator
  • Global Administrator

1. Register an Application in Entra ID​

  1. Log in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click New registration.
  4. Name the application (e.g., DataCentral Power BI Access) and click Register.
  5. Copy the Application (client) ID from the Overview tab — you will need this later.
  6. Go to API permissions and click Add a permission.
  7. Select Power BI Service and choose Application permissions.
  8. Add the following permissions:
    • Report.ReadWrite.All
    • Workspace.Read.All
    • Dataset.ReadWrite.All
    • Dashboard.ReadWrite.All
    • Content.Create
  9. Click Grant admin consent for your organisation.
  10. Go to Certificates & secrets and click New client secret.
  11. Add a description and set an expiration, then click Add.
  12. Copy the secret Value immediately — it will not be shown again.

2. Configure Power BI Tenant Settings​

  1. Log in to Power BI as a Power BI Administrator.
  2. Go to the gear icon > Admin portal > Tenant settings.
  3. Enable the following two settings (either organisation-wide or scoped to a specific security group containing your service principal):
    • Embed content in apps (under Integration settings)
    • Allow service principals to use Power BI APIs (under Developer settings)
  4. Click Apply on each.

Grant Workspace Access​

The Service Principal must be added to any workspace whose reports you want to import into DataCentral.

  1. In Power BI, open the workspace and click Manage access.
  2. Search for the service principal by the name you gave the app registration.
  3. Grant it at least Member permissions and click Add.

3. Configure DataCentral​

  1. Navigate to Administration > Settings > Azure Configurations.
  2. Enter the following values from your App Registration:
    • Directory (Tenant) ID
    • Application (Client) ID
    • Client Secret
  3. Click Save.

DataCentral is now authorised to access and embed reports from your Power BI workspaces.

Optional: Enable Only use Service Principal to manage items and workspaces to restrict DataCentral to only show workspaces and items accessible by the Service Principal.