Power BI service principal: let apps sign in without a user
Power BI service principal is an authentication method that lets a Microsoft Entra application reach Power BI content and APIs without a person signing in. It suits scheduled jobs and embedded reports, because no user account or password sits behind the code. However, it needs several settings in the right order. The steps, roles and limits follow below.
- No user account needed
- Admin setting required
- Workspace role required
Last updated
What is a Power BI service principal?
Microsoft Learn describes it as a way for a Microsoft Entra application to access Power BI service content and APIs. The identity appears when you create the application in Microsoft Entra ID. So the app, and not a person, owns the sign-in.
The app proves who it is with its application ID plus either a certificate or an application secret. Microsoft recommends certificates, since a secret is easier to leak. Either way, the credential needs the same care as an administrator password.
Why bother? A job that runs under a named employee breaks when that person leaves or changes a password. An application identity avoids that, and it also keeps personal accounts out of automated work.
How do you set up a Power BI service principal?
Microsoft documents the setup in this order, and each step depends on the one before.
Create the Entra application
First, register an app in Microsoft Entra ID and add a certificate or secret. The service principal comes with the registration.
Put it in a security group
Then create a Microsoft Entra security group and add the principal to it. A group makes the next setting easier to control.
Enable the tenant settings
Next, a Power BI administrator opens the Admin portal and finds Developer settings under Tenant settings. There they allow service principals to use Power BI APIs for that group.
Add it to a workspace
Finally, open Workspace access and add the principal or its group as Member or Admin. After that, the app can work with the content in that workspace.
Settings and roles an application identity depends on
Several people usually share the setup, so agree who owns each part.
| Requirement | Where it lives | Who handles it |
|---|---|---|
| App registration | Microsoft Entra ID | An Entra administrator or developer |
| Certificate or secret | The app registration | The owner of the app |
| Security group | Microsoft Entra ID | An Entra administrator |
| API tenant setting | Admin portal, Developer settings | A Power BI administrator |
| Embed content setting | Admin portal, Developer settings | A Power BI administrator |
| Workspace role | Workspace access in the workspace | A workspace Admin |
What can a Power BI service principal not do?
The limits matter as much as the setup. It cannot sign in to the Power BI portal, so nobody can use it to browse reports. My workspace is also off limits, and therefore all its work happens in shared workspaces.
Microsoft lists more limits. A move to production requires a capacity. Applications that embed for your own organization cannot use this method. Managing dataflows is also outside its reach.
Admin APIs need a separate decision. Read-only admin endpoints only accept a principal once an administrator enables that option. Also, when a model connects to Azure Analysis Services, the principal itself needs permissions on that source. For the calls such an identity makes, see the Power BI REST API guide, and for automated releases between workspaces, see Power BI deployment pipelines.
Which mistakes do teams make with app identities?
The most common one is adding API permissions to the app registration. Microsoft advises against that for this method, because access comes from the tenant setting and the workspace role instead.
Another is enabling the setting for the entire organization. A specific security group is the safer choice, since only principals you placed in it can call the APIs. It also gives auditors one short list to review.
Finally, teams forget the expiry date of the secret. When it lapses, every job that depends on it stops at once. So record the date, name an owner and renew before it expires.
App identity questions from Power BI administrators
Can a Power BI service principal open reports in the portal?
No. Microsoft states that it cannot sign in to the Power BI portal. It exists for code, such as a script that calls an API or an application that embeds a report. If a person needs to view content, give that person access in the normal way. Keeping the two apart also makes audit trails easier to read.
Which workspace role should a Power BI service principal have?
Microsoft's setup steps add it as Member or Admin. Choose the lower role that still lets the job work, because the principal then holds fewer rights if its credential leaks. Add it through Workspace access, either directly or through its security group. Remember that it cannot use My workspace, so content must live in a shared workspace.
Is a certificate better than a secret?
Microsoft recommends a certificate. A secret is a string, so it can end up in a script, an email or a chat message. A certificate is harder to copy by accident. Still, both need an owner, a safe store and a renewal date. Whichever you choose, keep it out of source files and limit who can read it.
Who has to enable the tenant setting?
A Power BI administrator does. The setting sits in the Admin portal under Tenant settings, in the Developer settings group. The administrator can apply it to the entire organization or to specific security groups. We suggest a specific group, because that keeps the list of allowed applications short and visible. Setting names change over time, so check Microsoft's current documentation.
Can you set this up with our IT team?
Yes. Power BI Agency plans and configures application identities together with your IT team. The work takes place online, inside your own Microsoft tenant, and your administrators keep control of every credential. We are a small group of our consultants, a division of Sataware Technologies, and independent of Microsoft. Book the free 30-minute assessment or call (480) 485-7373.
Let's build your first dashboard together.
Tell us what you report on today. A consultant replies within 2 hours with next steps.
Trusted partners
Microsoft Solutions Partner · AWS Partner
Cloud & AI Platforms
Azure SQL, Microsoft Fabric and the data pipelines behind your reports.
AI Business Solutions
Power BI reporting on your Dynamics 365, Business Central and Power Platform data.
Security
Row-level security and Entra ID sign-in on every report and workspace.
Amazon Web Services
Power BI on your AWS data, with connectors for Redshift, Athena and S3.