For companies with strict information security protocols, integrating Power BI through a service principal with app registration is a more favorable approach than using individual user accounts. This method addresses several challenges that often arise in user-based integrations.
For instance, when an employee’s role or permissions change, another user must re-authenticate, leading to potential disruptions. Similarly, with individual accounts, authentication tokens usually expire after a short period, forcing re-authorization and token refreshes every few months, which can be inconvenient.
By adopting a service principal, the authentication tokens are linked to a registered application rather than a user, extending their validity and reducing the frequency of re-authorization. Yodeck fully supports this approach for seamless Power BI integration.
Available only on the Enterprise plan!
This app is only available on the “Enterprise” Plan. You might not see some menus below if you are not on the “Enterprise” Plan.
Step 1 - Create a Microsoft Entra app in the Azure portal
App Compatibility
You must purchase a Power Bi embedded or enterprise capacity to use this app without limitations. Learn more
Sign in to the Azure portal.
Search for and select App registrations.
Select New registration.
Please fill out the Name for your application and leave the other information as is. You can change these options at any time.
Select Register.
After you register your app, the Application ID and Tenant ID are available from the Overview tab. Copy and save them for later use.
Select Certificates & secrets.
Select New client secret.
In the Add a client secret window, enter a description, specify when you want the client secret to expire, and select Add
Copy and save the client's secret value.
Info
⚠️After you leave this window, the client's secret value is hidden, and you can't view or copy it again.
Step 2 - Enable the Power BI service admin settings
Info
Power BI admin rights are required to enable service principals in developer settings within the Power BI Admin portal.
For a Microsoft Entra app to access the Power BI content and APIs, a Power BI admin needs to enable the following settings:
Embed content in apps
Allow service principals to use Power BI APIs
In the Power BI Admin portal, go to Tenant settings and scroll down to Developer settings.
Enable Embed content in apps for (*) the entire organization.
Enable Allow service principals to use Power BI APIs for (*) the entire organization.
Note
Service principals have access to any tenant settings they're enabled for. Depending on your admin settings, this includes specific security groups or the entire organization. We have applied the admin settings to the entire organization in this example.
To restrict service principal access to specific tenant settings, allow access only to specific security groups. Alternatively, you can create a dedicated security group for service principals and exclude it from the desired tenant settings.
Step 3 - Add the service principal to your workspace
Note
⚠️My Workspace isn't supported when using service principal.
In the Power BI service, scroll to the workspace you want to enable access to. From its More menu, select Workspace access.
In the Access pane, click the "Add people or groups" button.
You can add one of the following:
(We use this in our example) Your service principal. The name of your service principal is the Display name of your Microsoft Entra app, as it appears in your Microsoft Entra app's overview tab.
The security group includes your service principal.
On the drop-down menu, select Member and then click Add.
Your Access Pane should look like this:
Step 4 - Set up a Power BI with Service Principal in Yodeck
Search for the Power BI app in the apps gallery.
Select Use App
Select the log-in option "Authenticate with Service Principal".
Fill out all the required fields:
Name - A desired name for your Power Bi app.
Login - Click the Service Principal login button and enter your app's credentials.
URL - Enter the report/dashboard URL for which the service principal has access to.
(Optional) Hit Preview to check your Power BI app.
Hit Save.
Your Power Bi app with Service Principal authentication is now ready for use!
Common Problems
Power BI error: “Embed token has reached its limit”
This error comes from Microsoft Power BI, not Yodeck.
It means your Power BI workspace has reached Microsoft’s free embed token limit, which is required when displaying Power BI content in Yodeck using Service Principal authentication.
This can happen over time as usage increases (more screens, apps, or refreshes).
Power BI Pro does not remove this limit.
How to resolve it
To remove this restriction, Microsoft requires:
Power BI Embedded capacity, or
Power BI Premium capacity
This is a Power BI licensing limitation and cannot be fixed from the Yodeck side.
F.A.Q.s
Why do I see Checking permissions... instead of a report tile in my dashboard?
That happens when you try to view a dashboard containing a report, and the service principal lacks permissions for the report's semantic model. To solve this, you can manage the report's permissions and grant the service principal access to its semantic model.
Need Help?
The Yodeck Support Team can help you out! Log in to your Yodeck account and Send us a message from the bottom right corner!