Power BI · OAuth Scopes

Power BI OAuth Scopes

OAuth 2.0 searched

Power BI publishes 17 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Power BI API on a user’s behalf.

Tokens are issued from https://login.microsoftonline.com/common/oauth2/v2.0/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AnalyticsBusiness IntelligenceDashboardsData AnalysisReportingVisualization

Scopes: 17 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Token URL
https://login.microsoftonline.com/common/oauth2/v2.0/token https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Flows
authorizationCodeclientCredentials

Scopes (17)

Scope	Description	Flows
https://analysis.windows.net/powerbi/api/.default	Request all statically consented permissions (used by client-credentials / app-only flows).	clientCredentials, authorizationCode
Dataset.Read.All	View all datasets.	authorizationCode
Dataset.ReadWrite.All	Read and write all datasets.	authorizationCode
Report.Read.All	View all reports.	authorizationCode
Report.ReadWrite.All	Read and write all reports (clone, rebind, export, delete).	authorizationCode
Dashboard.Read.All	View all dashboards and tiles.	authorizationCode
Dashboard.ReadWrite.All	Read and write all dashboards.	authorizationCode
Workspace.Read.All	View all workspaces (groups).	authorizationCode
Workspace.ReadWrite.All	Read and write all workspaces (create, delete, manage users).	authorizationCode
Gateway.Read.All	View all on-premises data gateways and their datasources.	authorizationCode
Gateway.ReadWrite.All	Read and write all gateways and datasources.	authorizationCode
Content.Create	Create content such as workspaces, datasets, and reports.	authorizationCode
Tenant.Read.All	View all content in the tenant (admin/read-only; requires Power BI admin).	authorizationCode
Tenant.ReadWrite.All	Read and write all content in the tenant (admin).	authorizationCode
App.Read.All	View all Power BI apps.	authorizationCode
Capacity.Read.All	View all capacities.	authorizationCode
Capacity.ReadWrite.All	Read and write all capacities.	authorizationCode

📄 Provider scope reference: https://learn.microsoft.com/en-us/power-bi/developer/embedded/register-app

Source

OAuth Scopes

generated: '2026-06-20'
method: searched
source: Microsoft Entra ID (Azure AD) Power BI Service delegated permissions reference
docs: https://learn.microsoft.com/en-us/power-bi/developer/embedded/register-app
resource: https://analysis.windows.net/powerbi/api
note: >-
  Power BI authorizes via Microsoft Entra ID (Azure AD) OAuth 2.0. The curated
  OpenAPI declares only an http-bearer scheme, so no scopes are derivable from
  the spec; the scopes below are the documented Power BI Service delegated
  permissions requested against the resource
  https://analysis.windows.net/powerbi/api. Application permissions
  (client-credentials) use .default and are governed by tenant admin settings.
schemes:
  - name: AzureADOAuth2
    type: oauth2
    flows:
      - flow: authorizationCode
        authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
        tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
      - flow: clientCredentials
        tokenUrl: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
        note: Uses the .default scope; requires tenant admin consent and Power BI service admin settings.
scopes:
  - scope: https://analysis.windows.net/powerbi/api/.default
    description: Request all statically consented permissions (used by client-credentials / app-only flows).
    flows: [clientCredentials, authorizationCode]
  - scope: Dataset.Read.All
    description: View all datasets.
    flows: [authorizationCode]
  - scope: Dataset.ReadWrite.All
    description: Read and write all datasets.
    flows: [authorizationCode]
  - scope: Report.Read.All
    description: View all reports.
    flows: [authorizationCode]
  - scope: Report.ReadWrite.All
    description: Read and write all reports (clone, rebind, export, delete).
    flows: [authorizationCode]
  - scope: Dashboard.Read.All
    description: View all dashboards and tiles.
    flows: [authorizationCode]
  - scope: Dashboard.ReadWrite.All
    description: Read and write all dashboards.
    flows: [authorizationCode]
  - scope: Workspace.Read.All
    description: View all workspaces (groups).
    flows: [authorizationCode]
  - scope: Workspace.ReadWrite.All
    description: Read and write all workspaces (create, delete, manage users).
    flows: [authorizationCode]
  - scope: Gateway.Read.All
    description: View all on-premises data gateways and their datasources.
    flows: [authorizationCode]
  - scope: Gateway.ReadWrite.All
    description: Read and write all gateways and datasources.
    flows: [authorizationCode]
  - scope: Content.Create
    description: Create content such as workspaces, datasets, and reports.
    flows: [authorizationCode]
  - scope: Tenant.Read.All
    description: View all content in the tenant (admin/read-only; requires Power BI admin).
    flows: [authorizationCode]
  - scope: Tenant.ReadWrite.All
    description: Read and write all content in the tenant (admin).
    flows: [authorizationCode]
  - scope: App.Read.All
    description: View all Power BI apps.
    flows: [authorizationCode]
  - scope: Capacity.Read.All
    description: View all capacities.
    flows: [authorizationCode]
  - scope: Capacity.ReadWrite.All
    description: Read and write all capacities.
    flows: [authorizationCode]