This article provides a step-by-step instruction on how to enable Service Principal (SP) access to a Power BI workspace in dedicated capacity (Power BI Premium or embedded/A sku).

In the following, I will try to highlight the minimal number of steps necessary to enable Service Principal authentication. You can find all the details in the official documentation: Automate Premium workspace and dataset tasks using service principals.

Why Service Principal access?

In order to set up unattended jobs or pipelines that perform XMLA write operations (refresh, deploy, etc.) on a dataset in a Power BI workspace, we have to use a Service Principal. Specifically, if we want to use Tabular Editor’s command-line interface to perform a model deployment, we don’t have any other options, as the command-line does not allow interactive authentication, which is required on any tenant that has multi-factor authentication (MFA) enabled.

These are the steps we need to go through in order to set this up. Note, these steps has to be performed by a user with Power BI Administrator and Azure Active Directory Administrator permissions:

Enable XMLA read/write access on a Power BI workspace

For most scenarios that involve Tabular Editor, we need to enable XMLA read/write on our Power BI workspace.

  1. In the Power BI Admin Portal, go to Capacity Settings. If your organization uses Power BI Premium, locate the capacity that hosts your workspace under the “Power BI Premium” tab. If your capacity is a Power BI Embedded or A SKU, locate it under the “Power BI Embedded” tab. Click on the capacity name.
  2. Expand the “Workloads” section. Scroll down and locate the XMLA Endpoint dropdown. Set it to “Read Write”. Note: At the time of this writing, there’s a bug that requires you to also disable the “Dataflows” workload. Click “Apply”.
  3. At this point, you should be able to connect using interactive (personal) authentication and make changes to datasets in the workspace using Tabular Editor, provided your user is an administrator of the workspace. Use the following string as the “server name” when connecting:
powerbi://api.powerbi.com/v1.0//

Warning: Once you make a change to a dataset hosted in an XMLA write-enabled workspace using external tools such as Tabular Editor, you will no longer be able to download a .pbix file from the dataset. This is a limitation on the Power BI Service which will hopefully not apply once XMLA read/write reaches general availability (it’s still in preview as of this writing).