topic Re: Cannot list Dataflows as Admin via Service Principal in Developer

Cannot list Dataflows as Admin via Service Principal

Anonymous — Wed, 10 Apr 2024 13:37:39 GMT

Hi everyone,

I encountered a very weird situation today. My goal is to get a list of all dataflows in my tenant via the API (GetDataflowsAsAdmin) using a service principal / azure App.

For this I

registered an app in azure
did not give any permissions (especially non that need admin consent)
added said app/service principal to an Entra-ID-Group which is allowed to call the read-only admin API ("Service principals can access read-only admin APIs"). This is set in the PowerBI admin portal

Now, using python, I wanted to get the list of all dataflows but I get an 401 Unauhtorized and I am not sure why, since a lot of other admin APIs do work.

E.g. I can query the following and get results back:

But

https://api.powerbi.com/v1.0/myorg/admin/dataflows?$top=100

does not work (unauhtorized).

Does my service principal need additional permission just for dataflows? I could not get any information from the docs...so perhaps someone here knows more.

FYI: I first get an access token via msal for

authority = f'https://login.microsoftonline.com/{tenant_id}'

scope = ['https://analysis.windows.net/powerbi/api/.default']

Thank you,

Sven

Re: Cannot list Dataflows as Admin via Service Principal

Anonymous — Thu, 11 Apr 2024 03:00:59 GMT

HI Anonymous,

Have you take a look at the official document about how to use service principal with power bi rest api and its usage limitations? If not, I'd like to suggest you check them at first.

Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

Regards,
Xiaoxin Sheng

Re: Cannot list Dataflows as Admin via Service Principal

Anonymous — Thu, 11 Apr 2024 05:59:21 GMT

Thank you for your answer! Seems like I missed that article as I didn't think my problem had something to do with embedding.

It would be nice if there were some tags or markers that show which API is supported for service principals and which are not.

In this case it seems that I will have to use my own account.

Best,

Sven