How do I configure delegated permissions for my Microsoft Fabric API application?

Registered Single Tenant Microsoft Entra ID application:

NOTE: As mentioned in this MS-Document, To list the workspaces, Requires Delegated Scopes only Workspace.Read.All or Workspace.ReadWrite.All delegated type permissions works with user-interaction flow and if you want to use client credentials flow use application type permissions.

For listing the workspaces from your Microsoft Fabric, Added delegated type Workspace.Read.All API permission from Power BI Services and granted admin Consent like below:

Using delegated type, authorization_code flow which requires user-interaction. To get code, I ran below authorization request in browser:

BASHCopied
https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/authorize?  
client_id=<client_id>
&response_type=code  
&redirect_uri=https://jwt.ms
&response_mode=query  
&scope=https://analysis.windows.net/powerbi/api/.default
&state=12345

Use below Modified Python Script for using authorization_code flow:

PYTHONCopied
import msal
import requests
import json

# Configuration
CLIENT_ID = "<application-id>"
CLIENT_SECRET = "<client-secret>"
AUTHORITY = "https://login.microsoftonline.com/<your-tenant-id>"
REDIRECT_URI = "https://jwt.ms"  # Use redirect URI you configured in App Registration
SCOPE = ["https://api.fabric.microsoft.com/.default"]  # Scopes for Microsoft Fabric API

# Initialize the MSAL ConfidentialClientApplication
app = msal.ConfidentialClientApplication(
    CLIENT_ID,
    authority=AUTHORITY,
    client_credential=CLIENT_SECRET
)

authorization_code = input("Enter the authorization code you received after consent: ")

# Step 2: Exchange Authorization Code for Access Token
result = app.acquire_token_by_authorization_code(
    authorization_code,
    SCOPE,
    redirect_uri=REDIRECT_URI
)

if "access_token" in result:
    print("Access token obtained successfully.")
    access_token = result["access_token"]

    # Step 3: Make an API request to list all workspaces
    api_url = "https://api.fabric.microsoft.com/v1/workspaces"  # Adjust endpoint to list all workspaces

    headers = {
        "Authorization": f"Bearer {access_token}"
    }

    response = requests.get(api_url, headers=headers)

    if response.status_code == 200:
        # Parse the JSON response
        workspaces = response.json()
        print("List of Workspaces:")
        print(json.dumps(workspaces, indent=2))  # Pretty print the list of workspaces
    else:
        print(f"Failed to retrieve workspaces. Status code: {response.status_code}")
        print("Response:", response.text)
else:
    print("Error acquiring token.")
    print(result.get("error_description"))

After running this code, you will get prompt like Enter the authorization code you received after consent: Paste the authorization_code which you generated using above parameters from browser.

Response:

If you want to use application type permission needs to use client credentials flow which doesnot requires user-interaction.

Ensure to add your Microsoft Entra ID app registration to Power BI workspace with at least Reader access.

Go to Power BI Portal -> Your Workspace -> Click on ... -> Manage access -> +Add people or groups -> Search for Service Principal with name -> Reader

I added Admin access to my app registration:

Also check, have you allows access for service principals to call Power BI API by enabling below option in Tenant Settings of Admin Portal:

Use below modified Python code for listing the Workspace using Client Credential flow:

PYTHONCopied
import requests
import msal

TENANT_ID = "<tenant-id>"
CLIENT_ID = "<application-id>"
CLIENT_SECRET = "<client-secret>"
AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"
SCOPES = ["https://analysis.windows.net/powerbi/api/.default"]

app = msal.ConfidentialClientApplication(
    CLIENT_ID, authority=AUTHORITY, client_credential=CLIENT_SECRET
)

token_response = app.acquire_token_for_client(scopes=SCOPES)

if "access_token" in token_response:
    access_token = token_response["access_token"]
    print(" Token obtained.")

    headers = {
        "Authorization": f"Bearer {access_token}",
        "Content-Type": "application/json"
    }

    # Power BI API for listing workspaces
    url = "https://api.fabric.microsoft.com/v1/workspaces"
    response = requests.get(url, headers=headers)

    if response.status_code == 200:
        print(" Workspaces:", response.json())
    else:
        print(f" Error: {response.status_code} - {response.text}")

else:
    print(" Error getting token:", token_response.get("error_description"))

Response:

Reference:

List-Workspace