Service Principal

Creating a Service Principal and Connecting to Power BI

Use a Service principal for Power BI Sentinels connection to avoid token expirations, and provide a robust and secure connection method

Power BI Sentinel: Service Principal Setup

Why use a Service Principal?

Power BI Sentinel needs to sign in to your tenant to collect data. When using a standard user account, the access token expires after approximately 90 days - at which point data collection stops until someone manually signs in again. A Service Principal is a dedicated app identity whose token lasts up to 2 years, keeping the connection alive without any manual intervention.

✓No 90-day token expiry - connection stays active without periodic re-authentication
✓Uninterrupted data collection - no gaps caused by expired sessions
✓More secure - no personal credentials stored; uses a dedicated app identity
✓Required if your organisation uses Privileged Identity Management (PIM)
Video walkthrough

⚠ This video may contain dated references to the Azure or Power BI Admin portal interface. Use the written steps below as your primary guide.

A Power BI Admin user account is still needed for some data. A Service Principal cannot access all Power BI API endpoints. Even after configuring a Service Principal, a Power BI Admin user should still sign in to the Power BI Sentinel portal approximately every 90 days to maintain complete data coverage. The following data is only available via a Power BI Admin user account:
  • Documentation: Column & Measure Usage
  • Change Tracking
  • Apps Data
Section A — Azure Admin

App Registration

Create a dedicated app identity in Azure for Power BI Sentinel to use. This section has nothing to do with the Power BI Sentinel platform - all steps are completed in the Azure portal by your Azure Admin. No Sentinel portal access is needed.

Already have an App Registration set up? If you have previously created an App Registration for Power BI Sentinel and it already has the required delegated permissions assigned, skip to Section B.
Create a new App Registration in Azure Register a dedicated app identity for Power BI Sentinel Azure Admin
▾
☁️Azure Portal: App Registrations↗
  1. Click New Registration
  2. Set a name - for example PowerBISentinel
  3. Under Supported account types, select Accounts in this organizational directory only
  4. In the Redirect URI dropdown, select Web (leave the URI field blank)
  5. Click Register
Register application in Azure
Note your Application (Client) ID From the App Registration Overview page, copy and save the Application (client) ID Azure Admin
▾

After creating the registration you will land on its Overview page. Copy the Application (client) ID - a GUID in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. You will need this when configuring the Power BI Sentinel portal in Section D.

💡Save this in a notepad alongside the client secret you will create in the next step.
Create a Client Secret Certificates & Secrets → Client secrets → New client secret Azure Admin
▾
  1. In the left-hand menu, click Certificates & secrets
  2. Click the Client secrets tab, then New client secret
  3. Set expiry to 24 months
  4. Click Add
  5. Immediately copy the Value field. This is the only time it will be visible. If you navigate away without copying it, you must delete and recreate the secret.
Create client secret
⚠Copy the Value field, not the Secret ID. Both are GUIDs - the Value is in the left column.
Assign delegated API permissions Add the permissions below. Do not grant admin consent. Azure Admin
▾
Azure App Permissions

Microsoft Graph (Delegated)

  • User.Read - required to sign in

Power BI Service (Delegated)

  • App.Read.All
  • Capacity.Read.All
  • Dashboard.Read.All
  • Dataflow.Read.All
  • Dataset.Read.All
  • Dataset.ReadWrite.All (required for report backups)
  • Gateway.Read.All
  • Lakehouse.Read.All (optional - for Fabric Lakehouse data)
  • Pipeline.Read.All (optional - for pipeline data)
  • Report.Read.All
  • Report.ReadWrite.All (required for report backups)
  • StorageAccount.Read.All
  • StorageAccount.ReadWrite.All (required for backups)
  • Tenant.Read.All
  • Tenant.ReadWrite.All (required for SP workspace access)
  • Workspace.Read.All
  • Workspace.ReadWrite.All (required for SP workspace access)

Microsoft Graph (Application - optional)

  • Directory.Read.All - for Entra Groups and licence data
ℹDo not click "Grant admin consent" after adding permissions. Power BI Sentinel uses delegated permissions and handles consent through its own sign-in flow.
Section B — Azure Admin

Entra Security Group

The Power BI tenant settings you will enable in Section C must be scoped to a specific security group - they should not be enabled for the entire organisation.

Create a Security Group and add the App Registration as a member Create an Entra ID security group containing your App Registration Azure Admin
▾
☁️Azure Portal: Entra ID Groups↗
  1. Click New Group
  2. Group type: Security
  3. Name it something identifiable - for example PowerBISentinel-SP
  4. Click No members selected and search for the App Registration you just created, then add it as a member
  5. Click Create
Create security group
Section C — Power BI / Fabric Admin

Power BI Tenant Settings

Two settings must be enabled in the Power BI Admin portal. These allow the Service Principal to retrieve admin API data, including tenant information, audit logs, and scan API data.

Enable "Service principals can call Fabric public APIs" Admin portal → Tenant settings → Developer settings Power BI / Fabric Admin
▾
📊app.powerbi.com: Admin portal → Tenant settings↗
ℹEnable this for a specific security group only - not the entire organisation. Select the group you created in Section B.
  1. Go to Tenant settings → Developer settings
  2. Find "Service principals can call Fabric public APIs"
  3. Enable it, then select Specific security groups
  4. Add your PowerBISentinel-SP group and save
Enable "Service principals can access read-only admin APIs" Admin portal → Tenant settings → Admin API settings Power BI / Fabric Admin
▾
ℹSame rule - scope this to your security group only, not the entire organisation.
  1. In Tenant settings, find Admin API settings
  2. Find "Service principals can access read-only admin APIs"
  3. Enable it, select Specific security groups
  4. Add your PowerBISentinel-SP group and save
Section D — Power BI Sentinel Portal

Portal Configuration

Enter the Service Principal credentials into Power BI Sentinel, then configure workspace access.

Enter Client ID and Secret in the Power BI Sentinel portal Configure → Server Config → enable Use Service Principal → enter credentials and save Any PBS Admin
▾
ℹThis step can be completed by any Power BI Sentinel admin user - a Power BI Admin is not required. You are simply entering the Client ID and Secret values into the portal.
🔗portal.powerbisentinel.com/Configure↗
  1. Sign in to the Power BI Sentinel portal and go to the Configure screen
  2. Under Server Config, enable "Use Service Principal"
  3. Enter your Client ID (Application ID from Section A)
  4. Enter your Client Secret (the Value you copied in Section A)
  5. Click Save
Service Principal configuration in PBS portal

Advanced options - configure as follows:

Recommended - enable this

Always Use Service Principal for Backups

Routes all backup operations through the Service Principal rather than individual user accounts.

Not recommended - leave disabled

Only Use Service Principal

Disables fallback to user account authentication. This will prevent collection of Column & Measure Usage, Change Tracking, and Apps Data. Leave disabled unless advised by support.

Grant workspace access to the Service Principal The Service Principal must be a Contributor on your Power BI workspaces to collect data from them Power BI / Fabric Admin
▾

You have two options for granting the Service Principal Contributor access to your workspaces:

Option 1 - Manual

Manually add the App Registration as a Contributor member to each workspace in the Power BI Admin portal. This is straightforward for small tenants but impractical for larger ones.

Option 2 - Automated (Recommended)

Use the automated process in the Power BI Sentinel portal. See the steps below.

Automated process - prerequisites:

⚠The automated process requires a Power BI Admin to be signed in to the Power BI Sentinel portal with a valid, active token. If PIM is active and the admin role is set to expire during the process, or if the token has been inactive for more than 90 days, the process will stop before all workspaces are updated.

Before enabling the automated process, a Power BI Admin must first activate two specific permissions from their own user account in the portal. The steps for this are in the next task.

Activate the two workspace permissions in the portal (Power BI Admin required) These are user-level permissions for the signed-in Power BI Admin - not permissions on the Service Principal itself Power BI Admin — must be signed in
▾
ℹImportant: These permissions are granted to the currently signed-in user's account in the Power BI Sentinel portal - they are not settings on the Service Principal itself. The user performing this step must be a Power BI Admin, because the automated workspace process uses this user's access token to add the Service Principal to workspaces on their behalf.
🔗portal.powerbisentinel.com/Config/Permissions↗

Sign in to the portal as a Power BI Admin and go to the Application Permissions screen. In the Individual permissions tab, enable both of the following:

ScopeDescription
Tenant.ReadWrite.AllRequired for the SP to be assigned to workspaces
Workspace.ReadWrite.AllRequired for the SP to be assigned to workspaces
⚠Each permission will trigger a browser sign-out and sign-in cycle when activated. This is expected - it confirms the change was saved. After enabling both permissions, return to the Configure screen.
Enable automatic Contributor access to all workspaces Configure → Server Config → Grant Service Principal Contributor access to all workspaces Power BI Admin — must be signed in
▾
⚠This option only appears in the portal after the two permissions in the previous step have been activated. If you do not see it, complete the previous step first.
🔗portal.powerbisentinel.com/Configure↗
  1. Go to Configure → Server Config
  2. Enable "Grant Service Principal Contributor access to all workspaces automatically"
  3. Click Save

The Service Principal will use the signed-in Power BI Admin user's token to visit each workspace and add itself as a Contributor. This runs automatically in the background - the admin does not need to remain logged in, but their token must have been active within the last 90 days.

ℹRate limit: Power BI limits workspace membership changes to 200 workspaces per hour. For larger tenants this can take several hours or up to a full day. Progress runs automatically in the background.

Service Principal setup complete

Power BI Sentinel will now use the Service Principal for tenant connections. Remember to sign in with your Power BI Admin user account approximately every 90 days to keep user-account-dependent data current.