Microsoft Azure Power BI Embedded Management Client

What authentication does the Power BI Embedded Management API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret or refresh token is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I rotate the access keys for an embedded workspace collection?

Yes. POST /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.PowerBI/workspaceCollections/{workspaceCollectionName}/regenerateKey regenerates the chosen primary or secondary key, and the listKeys POST endpoint returns the current pair so rotation can be staged across the embedding application.

What are the rate limits for the Power BI Embedded Management API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. Provisioning is asynchronous and should be polled with backoff.

How do I provision an embedded workspace collection through Jentic?

Search Jentic for 'provision power bi embedded workspace collection', load the schema for PUT .../workspaceCollections/{workspaceCollectionName}, then execute with subscriptionId, resourceGroupName, location, and SKU. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Power BI Embedded Management API free?

There is no per-call charge for the management API itself; you pay for the Power BI Embedded capacity SKU you select on the workspace collection resource. Reads against the management plane are not separately metered.

Can I limit what my agent is allowed to do with the Power BI Embedded Management API?

Yes. Because Jentic One is self-hosted, you write the rules that decide which operations and credentials the agent may use, and the subscription, resource group, and workspace collection name all travel in the URL path, so you can pin the agent to a single collection and only the calls it needs. You choose the exact operations it can invoke, such as provisioning a collection or listing access keys, while leaving destructive ones like deleting a collection or regenerating a key out unless you explicitly add them. The Azure AD credential is stored once by your own instance and a scoped bearer token is supplied at execution time, so the agent never handles the raw secret.