Forum Discussion

LucyRose's avatar
LucyRose
Regular Visitor
2 years ago

Use PowerBIRestMethod to remove user from all PowerBI artifacts

Context: 
I have users not deleted from AD (entra) by design. However, I want to remove them from PowerBI reports/BI-App/etc.

  • I am BI-admin
  • I have already removed users from Workspaces
  • I can get a list of reports the user has access to using:

 

Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/admin/users/$userId/artifactAccess" -Method Get

 

 

The plan was to amend the JSON & Post this back but I am getting an error message.

"WriteError: (Microsoft.Power...werBIRestMethod:InvokePowerBIRestMethod)"


I have hundreds of users so manually doing this in the service is not an option.

Any insight would be greatly appreciated, I am happy to change the method to anything that works.

 

 

# Convert JSON string to PowerShell object
$artifactAccess = ConvertFrom-Json $artifactAccessJsonGet

# Iterate through each artifact and update accessRight to 'None'
foreach ($artifact in $artifactAccess.ArtifactAccessEntities) {
$artifact.accessRight = 'None'
}
# Convert the updated object back to JSON
$body = $artifactAccess | ConvertTo-Json

Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/admin/users/$userId/artifactAccess" -Method Post -Body $body -ContentType "application/json"

 


Many thanks

Need Help

2 Replies

  • Anonymous's avatar
    Anonymous
    Not applicable
    2 years ago

    Hi LucyRose ,

    Base on your description, it works to get the list of artifacts and modify the access rights. However, it seems like there is some issue with the permissions or the way the JSON is constructed. Please try to update the codes as below and check if it can get works:

    # Ensure you're logged in as an admin
Connect-PowerBIServiceAccount

# Retrieve the artifact access data
try {
    $artifactAccessJsonGet = Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/admin/users/$userId/artifactAccess" -Method Get
} catch {
    Write-Error "Failed to retrieve artifact access data: $_"
    break
}

# Check if data retrieval was successful
if (!$artifactAccessJsonGet) {
    Write-Error "No data retrieved."
    break
}

# Convert JSON string to PowerShell object
try {
    $artifactAccess = ConvertFrom-Json $artifactAccessJsonGet
} catch {
    Write-Error "Failed to convert JSON to PowerShell object: $_"
    break
}

# Iterate through each artifact and update accessRight to 'None'
foreach ($artifact in $artifactAccess.ArtifactAccessEntities) {
    $artifact.accessRight = 'None'
}

# Convert the updated object back to JSON
try {
    $body = $artifactAccess | ConvertTo-Json
} catch {
    Write-Error "Failed to convert PowerShell object to JSON: $_"
    break
}

# Post the updated JSON back to the API
try {
    Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/admin/users/$userId/artifactAccess" -Method Post -Body $body -ContentType "application/json" -Verbose
} catch {
    Write-Error "Failed to update artifact access: $_"
}

    Best Regards

    • LucyRose's avatar
      LucyRose
      Regular Visitor
      2 years ago

      So the verbose error I am receiving is  MethodNotAllowed (405). 
      It may be what I am including in my JSON. I am unsure whether to PUT, PATCH or POST & can not find any API specific documentation from Microsoft. Still, I find it hard to believe that we cannot administer access changes to reports at the report level. This is an example result of the earlier GET.  

       
      {
"@odata.context":"https:/xxxxxxeContracts.Api.Access.ArtifactAccessResponse",
"ArtifactAccessEntities":[
    {
"artifactId":"1xxxxxxx","displayName":"Report1","artifactType":"Report","accessRight":"ReadReshare"
    },{
      "artifactId":"2xxxxx","displayName":"Report2","artifactType":"Report","accessRight":"ReadCopy"
}
  ],"continuationUri":"https:/xxxxxxxx/artifactAccess?continuationToken='Lrrrrrrr'","continuationToken":"Lrrrrr"
}

      I have tried to invoke using just the ArtifactAccessEntities, & the whole thing including odata.context etc. 
      Same result.