Forum Discussion
Using Power BI API in C#
Hi bigmac025 ,
Thanks for the update and for sharing the decoded token details.
To clarify the point around roles and permissions, the documentation is referring to delegated Power BI permissions when it states that admin-consent required permissions must not be present for service principal authentication. In an app-only setup, the app registration should not have any delegated Power BI permissions configured.
This does not conflict with assigning a Power BI Admin or Fabric Admin tenant role to the service principal. Tenant roles are evaluated by the Power BI service at runtime and are separate from Azure AD delegated permissions. Admin REST APIs such as GetGroupsAsAdminAsync() are authorized based on tenant-level configuration, not on delegated scopes in the token.
So to address both points together, including AmosHersch 's comment, the presence of Tenant.Read.All or Tenant.ReadWrite.All in an app-only token does not cause the 401 and does not need to be removed. Those scopes are relevant only for delegated admin user tokens and are ignored when using service principal authentication.
Since the token itself is valid, a 401 from GetGroupsAsAdminAsync() still points to tenant-level authorization. Please recheck that service principal access is enabled in the Power BI Admin portal and that the service principal or its security group is allowed, that the service principal has a Power BI Admin or Fabric Admin tenant role, and that no delegated Power BI permissions are configured on the app registration.
Once these are in place, the updated code using GetGroupsAsAdminAsync() and GetReportsAsAdminAsync() should work as expected.
Hope this helps. Please reach out for further assistance.
Thank you.
Hi bigmac025 ,
Thanks for the update and for sharing the decoded token details.
To clarify the point around roles and permissions, the documentation is referring to delegated Power BI permissions when it states that admin-consent required permissions must not be present for service principal authentication. In an app-only setup, the app registration should not have any delegated Power BI permissions configured.
This does not conflict with assigning a Power BI Admin or Fabric Admin tenant role to the service principal. Tenant roles are evaluated by the Power BI service at runtime and are separate from Azure AD delegated permissions. Admin REST APIs such as GetGroupsAsAdminAsync() are authorized based on tenant-level configuration, not on delegated scopes in the token.
So to address both points together, including AmosHersch 's comment, the presence of Tenant.Read.All or Tenant.ReadWrite.All in an app-only token does not cause the 401 and does not need to be removed. Those scopes are relevant only for delegated admin user tokens and are ignored when using service principal authentication.
Since the token itself is valid, a 401 from GetGroupsAsAdminAsync() still points to tenant-level authorization. Please recheck that service principal access is enabled in the Power BI Admin portal and that the service principal or its security group is allowed, that the service principal has a Power BI Admin or Fabric Admin tenant role, and that no delegated Power BI permissions are configured on the app registration.
Once these are in place, the updated code using GetGroupsAsAdminAsync() and GetReportsAsAdminAsync() should work as expected.
Hope this helps. Please reach out for further assistance.
Thank you.
Hi bigmac025 ,
Just wanted to check if the response provided was helpful. If further assistance is needed, please reach out.
Thank you.
v-veshwara-msft Still going through all the advise and seeing if I can figure out the security.
Thanks
Tim
Thanks for the update, Tim.
No problem. This does point to tenant level security and role configuration rather than the code itself. Take your time reviewing those settings, and feel free to update the thread if you need further help.
Hi bigmac025 ,
Just checking in to see if you were able to make any progress on this. If you are still running into issues or have questions while reviewing the tenant settings, please let us know.Thank you.
