PowerBI Admin account REST API Group calls fail with 401, GroupNotAccessible

bdineen — Tue, 26 May 2020 20:49:02 GMT

I'm currently working on a powershell script to gather Power BI audit information for our BI team and export it to CSV so it can be used within Power BI. My SSO account has been assigned the role of Power BI Admin so I can make the relevant REST API calls. Most calls I'm trying to make return data as expected, but any time I try to make a group API call (e.g. api.powerbi.com/v1.0/myorg/groups/*), I get a 401 error. I also get the same error when using the "try it" button on the documentation pages, logging in with my SSO account, then providing the relevant parameters. From the "REST API Try It" page, the headers show "x-powerbi-error-info: GroupNotAccessible" when I get the 401s.

In my powershell script, I first call the "Login-PowerBI" cmdlet to set context with my user. The login window appears and I select my sso user account. After that I start making calls. This is an example call that works without error (please excuse my powershell code - I'm no expert):

# get gateways for use in subsequent calls Write-Host "Retrieving gateways..." $gatewayFileName = "C:\temp\gateways.csv" [System.Collections.ArrayList]$gateways = @() $gatewayInfo = Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/gateways" -Method Get | ConvertFrom-Json if ($gatewayInfo) { if ($gatewayInfo[0].value) { foreach ($gw in $gatewayInfo[0].value) { $gateways.Add($gw) } } } $gateways | ForEach-Object {$_}| Export-Csv -Path $gatewayFileName -NoTypeInformation

I get a list of gateways back and I create the file accordingly. Here's an example call to get the refresh history for a given dataset within a group. This gives me a very generic "One or more errors occurred" error in powershell, but if I use "Resolve-PowerBIError -Last", I can see that the error is actually a 401 (unauthorized):

Write-Host "Retrieving dataset refresh history..." $dsRefreshHistoryFileName = "C:\temp\dataset_refresh_history.csv" [System.Collections.ArrayList]$dsRefreshHistory = @() foreach ($groupId in $groupDatasets.Keys) { foreach($gds in $groupDatasets["$groupId"]) { $url = "https://api.powerbi.com/v1.0/myorg/groups/$($groupId)/datasets/$($gds.id)/refreshes" $url $histContainer = Invoke-PowerBIRestMethod -Url $url -Method Get | ConvertFrom-Json if ($histContainer) { if($histContainer[0].value) { foreach ($hist in $histContainer[0].value) { $hist | Add-Member -NotePropertyName DatasetId -NotePropertyValue $gds.id $dsRefreshHistory.Add($hist) } } } } } $dsRefreshHistory | ForEach-Object {$_} | Export-Csv -Path $dsRefreshHistoryFileName -NoTypeInformation

The $groupDatasets variable is a hashtable populated by first retrieving the groups with this API:

https://api.powerbi.com/v1.0/myorg/admin/groups?`$expand=dashboards&`$top=$topCount&`$skip=$skipCount

Then looping through each group ID and making this API call:

https://api.powerbi.com/v1.0/myorg/admin/groups/$($group.id)/datasets

This all seems to work as I get group data back from both of those calls. However I don't appear to be able to use the non-Admin group API calls without the aforementioned error. I don't think my powershell is at fault as I get the same error when using the same URL in the "REST API Try It" links from the documentation.

Is my account, with the PowerBI-Admin role, not allowed to make ALL REST API calls, or do I need to have rights to specific groups in order to pull that information? The documentation calls out the required scope (e.g. "Workspace.Read.All" or "Workspace.ReadWrite.All"), but does having the Power BI admin role not give me that access? My apologies if I've missed something fundamental here.

Thank you for your time!

Re: PowerBI Admin account REST API Group calls fail with 401, GroupNotAccessible

bdineen — Wed, 03 Jun 2020 11:16:57 GMT

I spoke with an Architect at Microsoft and they confirmed that my Power BI Admin user account still has to be a member of the group/workspace and dataset that I'm calling those particular APIs for. They were kind enough to point me to this article which details how permissions work in Power BI:

https://www.sqlchick.com/entries/2018/12/1/how-permissions-work-for-a-power-bi-service-administrator

After getting my account added to one of the sample groups and datasets, I was able to call the APIs in my script without getting the 401 error.

topic PowerBI Admin account REST API Group calls fail with 401, GroupNotAccessible in Developer

PowerBI Admin account REST API Group calls fail with 401, GroupNotAccessible

Re: PowerBI Admin account REST API Group calls fail with 401, GroupNotAccessible