Forum Discussion
Impactful IndividualRefresh Semantic model based Service Principal
there is an existing workflow available in logic app to refresh power bi dataset as shown below , currently the refresh dataset step is configured based on personal credentials which causing power bi job fails sometimes due to credentials change, i want to configure this refresh dataset step based on service principal instead of using personal account, how to do it in logic app?
Hi powerbiexpert22,
You can replace the existing “Refresh a dataset” action with an HTTP action that calls the Power BI REST API using a service principal.
First, register an app in Microsoft Entra ID and create a client secret. Then enable service principal access to the Power BI APIs in the Admin portal and add the service principal to the workspace containing the semantic model.
In your Logic App, use the service principal credentials to obtain an access token for Power BI, then send a POST request to:
https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes
Replace {workspaceId} and {datasetId} with the actual IDs.
You can find the API details here: https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/refresh-dataset-in-group
One thing to keep in mind: using a service principal for the API call doesn't change the credentials configured for the semantic model's data source. Those credentials need to be configured separately to avoid refresh failures caused by expired or changed data source credentials.
2 Replies
- ShahRukhSameer
Solution Sage
Hi powerbiexpert22,
You can replace the existing “Refresh a dataset” action with an HTTP action that calls the Power BI REST API using a service principal.
First, register an app in Microsoft Entra ID and create a client secret. Then enable service principal access to the Power BI APIs in the Admin portal and add the service principal to the workspace containing the semantic model.
In your Logic App, use the service principal credentials to obtain an access token for Power BI, then send a POST request to:
https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/refreshes
Replace {workspaceId} and {datasetId} with the actual IDs.
You can find the API details here: https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/refresh-dataset-in-group
One thing to keep in mind: using a service principal for the API call doesn't change the credentials configured for the semantic model's data source. Those credentials need to be configured separately to avoid refresh failures caused by expired or changed data source credentials.
- ShivekMaharaj
Community Champion
Hi powerbiexpert22,
For this scenario, I would not keep the existing Power BI "Refresh a dataset" connector action if the goal is to remove the dependency on a personal user account.
The standard Power BI connector in Logic Apps uses a signed-in Power BI connection. Microsoft currently documents the connector with the normal user sign-in authentication model, rather than a service-principal authentication option.
A more durable approach is to replace that action with an HTTP action and call the Power BI REST API refresh endpoint using a Microsoft Entra service principal.
The Logic App HTTP action supports Microsoft Entra OAuth authentication, so you can configure it with your tenant ID, application/client ID and a client secret or certificate.
The request would target the semantic model refresh endpoint for the required workspace and semantic model:
POST /groups/{workspaceId}/datasets/{datasetId}/refreshesYou will also need to make sure the service principal is allowed to use the relevant Power BI/Fabric APIs in the tenant settings and has sufficient access to the workspace containing the semantic model. Microsoft describes the service-principal setup and workspace access model in the service principal guidance.
That way, the refresh is executed using an application identity rather than an employee's Power BI connection, so password changes or user-account lifecycle changes no longer affect the Logic App.
If possible, I would also store the client secret in Key Vault rather than directly in the workflow definition, or use a certificate-based credential for a longer-lived production setup.
AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.
