How to Configure Service Principal in Azure

This guide explains step by step how to create a Service Principal (App Registration) in Azure to connect AtlasData to your Power BI.

Why use Service Principal?

Service Principal offers:

• Permanent access: Doesn't expire like user tokens
• Security: Credentials separate from personal account
• Auditing: App-specific access logs
• Control: Granular permissions per workspace

Prerequisites

Before starting, you need:

• Administrator access to Azure Active Directory
• Administrator access to Power BI
• Permission to create App Registrations

Step 1: Create the App Registration

1. Go to the Azure Portal
2. Navigate to Azure Active Directory > App registrations
3. Click New registration
4. Fill in the fields:
   • Name: AtlasData-PowerBI (or your preferred name)
   • Supported account types: "Accounts in this organizational directory only"
   • Redirect URI: Leave blank
5. Click Register

Step 2: Get the Credentials

After creating the app, you'll see the Overview page. Note the following values:

Field	Where to find	Example
Tenant ID	Overview > Directory (tenant) ID	12345678-1234-1234-1234-123456789abc
Client ID	Overview > Application (client) ID	87654321-4321-4321-4321-cba987654321

Step 3: Create the Client Secret

1. In the sidebar, click Certificates & secrets
2. In the Client secrets tab, click New client secret
3. Fill in:
   • Description: AtlasData Access
   • Expires: Choose the duration (recommended: 24 months)
4. Click Add
5. IMPORTANT: Copy the Value immediately (it only appears once!)

Field	Where to find
Client Secret	Certificates & secrets > Value

Attention

The Client Secret value is only shown once. If you lose it, you'll need to create a new one.

Step 4: Configure API Permissions

1. In the sidebar, click API permissions
2. Click Add a permission
3. Select Power BI Service
4. Choose Delegated permissions and check:
   • Workspace.Read.All
   • Report.Read.All
   • Dataset.Read.All
5. Click Add permissions
6. Click Grant admin consent for [your organization]

Step 5: Enable Service Principal in Power BI

1. Go to the Power BI Admin Portal
2. Go to Tenant settings
3. Find the Developer settings section
4. Enable Allow service principals to use Power BI APIs
5. Choose Specific security groups and add your Service Principal's group

Tip

Create a Security Group in Azure AD containing your Service Principal for easier management.

Step 6: Add to Workspaces

For each workspace that AtlasData should access:

1. Open the workspace in Power BI
2. Click Access (people icon)
3. Add the Service Principal as Member or Viewer
4. Save the changes

Step 7: Test in AtlasData

1. Access AtlasData and go to the connection step
2. Choose Service Principal
3. Enter the credentials:
   • Tenant ID: (copied in Step 2)
   • Client ID: (copied in Step 2)
   • Client Secret: (copied in Step 3)
4. Click Test Connection
5. If everything is correct, you'll see the success message

Troubleshooting

Error: "Unauthorized"

• Verify that Admin Consent was granted (Step 4)
• Verify that Service Principal is enabled in Power BI (Step 5)

Error: "No workspaces found"

• Verify that Service Principal was added to the workspaces (Step 6)
• Wait a few minutes for permission propagation

Error: "Invalid client secret"

• The Client Secret may have expired
• Create a new secret and update in AtlasData

Next Steps

• Power BI Permissions
• Troubleshooting
• Configure Admin Consent (alternative)