Forum Discussion
Can't add dataset application perms for Power BI Azure integration?
I'm trying to let a Service Principal account refresh my Power BI semantic model from a Python script. I've registered the app through Azure. I've done:
- Added the Service Principal account to the workspace.
- I've enabled Service Principals to use Fabric APIs and have been personally added to an included security group, though the Service Principal is not in one of those groups yet
- I've tried doing enabling Service principals can access read-only admin APIs
But when I go to add API application permissions, I only see Tenant permissions. I can see the dataset ones for delegated permissions, but I need these for applications instead. Am I missing something besides adding the app to a security group?
Hi FabricUser101 ,
Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.
In addition to Akash_Varuna & tackytechtom responses.
Since you’ve already enabled Allow service principals to use Fabric APIs, let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Microsoft LearnYou’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.
Roles in workspaces in Power BI - Power BI | Microsoft Learn
Regards,
Yugandhar.
10 Replies
- Akash_Varuna
Super User
Hi FabricUser101 Add the Service Principal to a security group with Power BI and Fabric API access. In Azure, grant application permissions for Power BI APIs, using Microsoft Graph if necessary. Enable Service Principal for APIs in Power BI Admin settings and include the security group. Finally, have an admin grant consent to the permissions in Azure.
V-yubandi-msftCommunity Support
Hi FabricUser101 ,
Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.
In addition to Akash_Varuna & tackytechtom responses.
Since you’ve already enabled Allow service principals to use Fabric APIs, let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Microsoft LearnYou’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.
Roles in workspaces in Power BI - Power BI | Microsoft Learn
Regards,
Yugandhar.
Thank you Akash_Varuna and V-yubandi-msft ! Adding the service principal to a security group that was included in the allowed security groups was all I needed. I don't even need to select which API perms.
- tackytechtom
Most Valuable Professional
Hi FabricUser101 ,
I happened to have written a couple of blog articles about refreshing semantic models, where the setup is also explained:
https://www.tackytech.blog/how-to-refresh-power-bi-datasets-from-data-factory-with-managed-identity/#-1.-Create-a-security-group-in-Azure-and-add-the-managed-identity-of-the-data-factory-to-itIn the case above, we used a data factory pipeline that refreshed a semantic model via managed identity. However, the concept with security groups and allowing APIs and stuff, should be the same (see step 1 and 2).
Can you try it the way its explained in the blog article? If this does not work, can you provide some more information on from where you wanna do the refresh call e.g. is it a notebook inside fabric? Then you could use semantic-link for that.
/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/ Does the solution above also work for executing queries on the data? I seem to be getting an 401 error when i want to evaluate tables. I did all of the above.
- V-yubandi-msft
Hi davidschiedam ,
The steps I mentioned earlier are mainly for refreshing a semantic model, while running queries against the dataset is a separate process.
If you’re seeing a 401 error when evaluating tables, it typically means the Service Principal lacks the necessary API permissions. For queries, you’ll need to assign the app Dataset.Read.All or Dataset.ReadWrite.All application permissions in Azure AD and ensure tenant admin consent is provided. Without these permissions, the token won’t include the required scopes for querying data.
Be sure to also check.
1. The Service Principal is added to the workspace with at least Contributor or Member access.
2. Authentication is done using the Service Principal’s client ID and secret/cert, rather than a user token.
3. Allow service principals to use Fabric APIs is enabled and the Service Principal is included in the allowed group.
With these settings in place, the Service Principal will be able to refresh and query datasets, and the 401 error should be resolved once the Dataset permissions are configured.
Please give it a try.
Hey V-yubandi-msft ,
Thanks for your reply.
You state that I should assign the app (so PowerBI Service?) Dataset.Read.All (or ReadWrite.All) application permissions. But the problem is that these are not available. At least not as an application permission, but only as a delegated. That won't work with a Service Principal The only application-permissions are for tenants
Or is there any other way to add these app permissions, for example through PowerShell?
I get a bearer token with the Service Principal's client ID and secret, so no user token.
Hope to hear from you!
