Overview
A service principal lets the new Yodeck Power BI app connect to Power BI through a Microsoft Entra app registration instead of a personal Microsoft account. Because the authentication belongs to the app and not to a user, your screens keep playing when employees change roles or passwords, and you re-authorize far less often. This guide walks you through the one-time setup in Azure and Power BI, and then the app setup in Yodeck.
For every setting of the app, including the Microsoft Account option, see the Power BI article.
Available on the Premium & Enterprise plans
You might not see some of the menus below if your account is on a different plan
Power BI capacity required
To use this app without limitations, your Power BI workspace needs a Power BI Embedded, Premium or Microsoft Fabric capacity. Learn more.
Step 1 – Create a Microsoft Entra app in the Azure portal
Sign in to the Azure portal.
Search for and select App registrations.
Selecting App registrations in the Azure portal
Select New registration.
Starting a new registration
Enter a Name for your application and leave the other options as they are. You can change them at any time.
Naming the application
Select Register.
On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID and keep them for later. In Yodeck, they go into the Client ID and Tenant ID fields.
Copying the client ID and the tenant ID
Select Certificates & secrets.
Opening Certificates and secrets
Select New client secret.
Creating a new client secret
In the Add a client secret window, enter a description, choose when the secret expires and select Add.
Setting the description and expiry
Copy the secret’s Value (not the Secret ID) and keep it for later. It goes into the Client Secret field in Yodeck.
Copying the secret value
Copy the secret value now
After you leave this page, Azure hides the secret value and you cannot view or copy it again.
Note the expiry date
The client secret expires on the date you chose. Create a new secret before that date and enter it in the Power BI app in Yodeck, so your screens keep playing.
Step 2 – Enable the Power BI service admin settings
Power BI admin rights required
Only a Fabric (Power BI) administrator can change these settings in the Admin portal.
For a Microsoft Entra app to access Power BI content and APIs, a Power BI admin needs to enable two settings. In the Power BI Admin portal, go to Tenant settings and scroll down to Developer settings:
Enable Embed content in apps for the entire organization or for a security group that includes your service principal.
Enabling Embed content in apps
Enable Service principals can call Fabric public APIs for the same scope. In some tenants, this setting still appears as Service principals can use Fabric APIs or Allow service principals to use Power BI APIs.
Allowing service principals to use the APIs
Note
Service principals have access to every tenant setting they are enabled for. This example enables the settings for the entire organization. To limit access, enable them only for specific security groups, or create a dedicated security group for service principals and exclude it from the settings you want to protect.
Step 3 – Add the service principal to your workspace
Workspaces only
With a service principal, only Workspaces are available in Yodeck. My Workspace and Power BI Apps are not supported. Add the service principal to every workspace whose content you want to show.
In the Power BI service, open the workspace you want to give access to and select Manage access.
Opening Manage access
In the Access pane, select Add people or groups.
Adding people or groups
Add one of the following:
Your service principal (used in this example). Its name is the Display name of your Microsoft Entra app, as shown on the app’s Overview page.
A security group that includes your service principal.
Finding the service principal
Select Member in the drop-down menu and then select Add.
Adding it as a Member
The Access pane now lists the service principal as a Member.
The service principal as a Member
Step 4 – Set up the Power BI app with Service Principal in Yodeck
In the Yodeck Portal, open the Apps section, locate the Power BI app in your app gallery and click Use App.
Selecting the Power BI app
In the Choose your log-in option window, select Authenticate with Service Principal.
Choosing Authenticate with Service Principal
In the Authenticate via service principal window, enter the Tenant ID, Client ID and Client Secret from Step 1 and click Authenticate. All three fields are required.
Entering the service principal credentials
Enter a Name for the app and an optional Description.
Click Select Resource and choose the dashboard or the report you want to display. The list shows only the content of the workspaces you added the service principal to.
The Power BI app with Service Principal
If you selected a report, click Open view editor, choose the page, bookmarks and filters you want to show and click Save Selection.
Selecting the view in the view editor
If your report uses Row-Level Security or user impersonation, add an identity with Set Identities, as described in the Identity Requirements guide.
Adjust the remaining settings if needed (refresh rate, display options, Semi-static, tags, duration and availability) and click Save. For details on each setting, see the Power BI article.
Your Power BI app with Service Principal authentication is now ready to use.
This error comes from Microsoft Power BI, not from Yodeck. It means your workspace has reached Microsoft’s free embed token limit, which applies when Yodeck displays Power BI content with Service Principal authentication. It can happen over time as usage grows (more screens, apps or refreshes). Power BI Pro licenses do not remove this limit.
To remove the limit, Microsoft requires the workspace to run on a Power BI Embedded, Premium or Microsoft Fabric capacity. This is a Power BI licensing requirement, and Yodeck cannot change it.
The dashboard contains a report whose semantic model (dataset) the service principal cannot access. Grant the service principal access to that semantic model in the Power BI service, and the tile appears.
Dashboards and reports in Workspaces where the service principal is a Member or Admin. My Workspace and Power BI Apps are not supported.
The service principal is probably not a member of that workspace. Add it as described in Step 3, then reopen Select Resource. If the workspace still does not appear, use the Refresh sources button in the list.
The report has no semantic model (dataset) attached, so Yodeck cannot embed it. Hover over the report to see the message No dataset ID found.
In Azure, create a new client secret as described in Step 1 and copy its value. Then edit the Power BI app in Yodeck, reconnect the service principal through the Authentication field with the new client secret and save the app.
No. The new Power BI app lists your dashboards and reports in Select Resource. URLs apply only to apps created with the legacy Power BI app. For details, see the Power BI article.
Need Help?
The Yodeck Support Team can help you out! Log in to your Yodeck account and send us a message from the bottom right corner!