Forum Discussion

bigmac025's avatar
bigmac025
Helper I
7 months ago
Solved

Using Power BI API in C#

Hello,   I was wondering if anyone has experiance to use the Power BI API in C#?   I have created a C# .NET Console App using the PowerBI API Library to connect to the Power BI API to get a list ...
Need Help
  • v-veshwara-msft's avatar
    v-veshwara-msft
    7 months ago

    Hi bigmac025 ,

    Thanks for the update and for sharing the decoded token details.

    To clarify the point around roles and permissions, the documentation is referring to delegated Power BI permissions when it states that admin-consent required permissions must not be present for service principal authentication. In an app-only setup, the app registration should not have any delegated Power BI permissions configured.

     

    This does not conflict with assigning a Power BI Admin or Fabric Admin tenant role to the service principal. Tenant roles are evaluated by the Power BI service at runtime and are separate from Azure AD delegated permissions. Admin REST APIs such as GetGroupsAsAdminAsync() are authorized based on tenant-level configuration, not on delegated scopes in the token.

     

    So to address both points together, including AmosHersch 's comment, the presence of Tenant.Read.All or Tenant.ReadWrite.All in an app-only token does not cause the 401 and does not need to be removed. Those scopes are relevant only for delegated admin user tokens and are ignored when using service principal authentication.

     

    Since the token itself is valid, a 401 from GetGroupsAsAdminAsync() still points to tenant-level authorization. Please recheck that service principal access is enabled in the Power BI Admin portal and that the service principal or its security group is allowed, that the service principal has a Power BI Admin or Fabric Admin tenant role, and that no delegated Power BI permissions are configured on the app registration.

     

    Once these are in place, the updated code using GetGroupsAsAdminAsync() and GetReportsAsAdminAsync() should work as expected.

     

    Hope this helps. Please reach out for further assistance.
    Thank you.

Ahmed-Elfeel's avatar
Ahmed-Elfeel
Super User
7 months ago

Hi bigmac025,

Your Code almost fine and the 401 error is caused due to authentication configuration (not the Power BI SDK itself)

Also the two biggest issues I see are token audience and admin or service principal permissions that caused this issue.

 

  • So you need to ensure the access token is for Power BI (most common issue)

    • Keep in mind even if you successfully get a token....Power BI will return 401 if the token was issued for the wrong resource So when using client credentials the token must be requested with this scope:

https://analysis.windows.net/powerbi/api/.default
  • Also If the token’s aud claim is anything else like Microsoft Graph for an example.....Power BI will reject it

 

  • Make Sure to Use the correct Power BI base URL which is:
var apiUrl = "https://api.powerbi.com/";

 

  • Also you need to know that GetGroupsAsAdminAsync() requires admin or service principal setup

    • The token belongs to a Power BI / Fabric Admin user or you are using a service principal (and Allow service principals to use Power BI APIs is enabled in Power BI Admin Portal)

    • If you dont need tenant wide access remove this line to be like this:
client.Groups.GetGroupsAsync()

 

  • The Last thing thats for app only authentication the service principal must be added to the workspace explicitly (Viewer/Contributor/Admin) or included in an AAD security group that has workspace access (

    Otherwise Power BI will return 401 or 403, even with a valid token)

if this post helps, then I would appreciate a thumbs up and mark it as the solution to help the other members find it more quickly.