Glossary
What is service principal?
A service principal is the identity of an application in Microsoft Entra ID. An application uses it to sign in without a personal account, for example to request embed tokens through the Power BI REST API.
Service principal explained
You create a service principal by adding an app registration in Microsoft Entra ID. It gets a client ID and a secret or certificate that the application uses to sign in. For Power BI, an administrator also has to allow service principals to use the APIs in the tenant settings, and you add the service principal to the workspace that holds the reports.
The advantage over a personal service account is that no employee's password sits in the application and no two-factor prompt gets in the way. A service principal belongs to the application, not to a person who might leave.
Watch the secret: it expires after a set period and must then be renewed, or the embedded reports stop working. Store it encrypted and give the service principal access only to the workspaces it really needs.
Example
Data Analytics creates an app registration in Acme Groothandel's Entra tenant and adds it to the "Reporting" workspace. The portal uses that identity to request embed tokens, without using any Acme employee's password.
Service principal in ENABLE
ENABLE embeds Power BI reports through a Microsoft Entra service principal that can be configured per customer. Its secret is stored encrypted with AES-256-GCM.
FAQ
Frequently asked questions
What is the difference between a service principal and a service account?
A service principal is an identity for an application, while a service account is an ordinary user account used by an application. A service principal has no personal password or 2FA, which makes it a better fit for automated connections such as Power BI Embedded.
How do you give a service principal access to Power BI?
A Power BI administrator allows service principals to use the APIs in the tenant settings, preferably limited to a security group. You then add the service principal as a member or admin of the workspace that holds the reports.
What happens when a service principal's secret expires?
The application can no longer sign in and embedded reports stop loading. Renew the secret in good time and update it in the application.
Further reading
- ResourcesWhat is Power BI Embedded? Scenarios and optionsPower BI Embedded is the way to show Power BI reports and dashboards in your own application, website or portal, instead of in Microsoft's Power BI service. There are two variants: embedding for your organisation, where users sign in with their own Microsoft account, and embedding for your customers, where the application handles access through a service principal and end users do not need a Power BI licence. For that second variant, you need capacity in production.Read more
- IntegrationPower BI embedded portal: share dashboards securelyPower BI reports embedded in your own portal, with access by role and RLS.Read more
- PlatformPower BI row-level security and dashboard accessAccess profiles, Power BI row-level security, two-factor authentication and an audit log.Read more
- ResourcesGlossary of data, AI and Power BI termsWhat is a service principal, row-level security, a semantic model, text-to-SQL or RAG? Short, clear definitions of terms around data, Power BI and AI.Read more
Use AI on your own data. Securely, and without the headache.
In an online demo we show how ENABLE makes your data securely available and how you build on it: describing an app in the AI Builder, plain-language questions, dashboards and APIs. And how we set it up and manage it for you.