Forum Discussion
Helper IPower Bi REST API - 401 Authorization error when using app secret
Hi tripleacoder,
As far as I know, the permissions of Power BI are all based on the users. So an App can't act as a user. Please refer to developer/power-bi-permissions where all the descriptions have "user".
Regarding "Tenant.ReadWrite.All", the documentation above also has a description. Actually, these permissions only can retrieve the profiles rather than data. Please refer to admin/reports_getreportsasadmin.
One simple proof we can see is that even an admin can't access all the App workspaces. The data is the precious asset of a company. I think this is reasonable.
Best Regards,
Dale
Microsoft EmployeeHi tripleacoder,
Your requirements are quite clear now. You'd like to use the App secret (aka client secret) instead of the user password authentication. I'm afraid this isn't workable in Power BI. The reason is simple. Even the global admin can't access other's contents. How can an App access everything?
Best Regards,
Dale
Helper I
v-jiascu-msft wrote:
Your requirements are quite clear now. You'd like to use the App secret (aka client secret) instead of the user password authentication. I'm afraid this isn't workable in Power BI. The reason is simple. Even the global admin can't access other's contents. How can an App access everything?
Thanks. This MS sample posts data to a custom Web API using the same method (but with a custom role):
https://azure.microsoft.com/en-us/resources/samples/active-directory-dotnet-daemon/
Can you explain a bit more why that won't work with the Power BI REST API? Perhaps also with a link to some documentation...
The app has the permission (=role) "Tenant.ReadWrite.All" which I supposed was for this purpose.
- v-jiascu-msft
Hi tripleacoder,
As far as I know, the permissions of Power BI are all based on the users. So an App can't act as a user. Please refer to developer/power-bi-permissions where all the descriptions have "user".
Regarding "Tenant.ReadWrite.All", the documentation above also has a description. Actually, these permissions only can retrieve the profiles rather than data. Please refer to admin/reports_getreportsasadmin.
One simple proof we can see is that even an admin can't access all the App workspaces. The data is the precious asset of a company. I think this is reasonable.
Best Regards,
Dale
boylecAdvocate I
This doesn't make any sense.
Power BI released all of this documentation saying that consumers could use service principals to embed reports but we can't use service principals to list the reports in a workspace that the service principal is an admin member of?
This is all fine except for one thing: You have to infer the "user Apps only" status of Power BI dataflows.
Something explicit along these lines would have saved me the better part of a week chasing my tail.