topic Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app in Developer

Power BI REST API - retrieving activity events returns 403 / "API is not accessible for application"

micpol — Thu, 07 Jan 2021 13:58:56 GMT

Hello,

I am trying to get activity logs using a Power BI secrvice principal. Once a valid access token is retrieved, it is possible to use the Power BI REST API for example to get the groups (GET https://api.powerbi.com/v1.0/myorg/groups) - it works fine.

Hoerver, when I attempt to get activity events (GET https://api.powerbi.com/v1.0/myorg/admin/activityevents) a 403 Forbidden error with the following message is returned:

{

"Message": "API is not accessible for application"
}

The service principal has all requires scopes and also the admin role. The doc says that it is possible to "authenticate via service principal" (ref. to https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents), so my understaing is that this API can be used with a service principal.

Any idea?

Best regards,

Michal

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

V-lianl-msft — Mon, 11 Jan 2021 05:52:54 GMT

Hi @micpol ,

You must meet these requirements to access the Power BI activity log:

You must either be a global admin or a Power BI service admin.
You have installed the Power BI Management cmdlets locally or use the Power BI Management cmdlets in Azure Cloud Shell.

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

micpol — Mon, 11 Jan 2021 08:05:18 GMT

Hi @V-lianl-msft ,

thank you for your reply.

My case is related to embedding content for customers (https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-sample-for-customers?tabs=net-framework , https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal ), so I am using a Power BI servcice principal (App account), not an AAD user account.

The service principal has been added to Power BI service admin list as well as required scopes have been set correctly.

Furthermore, I am talking to the Power BI service by means of the REST API (https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents) from within my application (backend), I am not using any Power BI Management cmdlets.

According to https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents it is possible to get authenticated via service principal. Note that other Power BI REST APIs are working fine.

In this particular case the message I am facing is "API is not accessible for application" and the HTTP error code is 403 Forbidden. It seems to me that the https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents does not work with a service principal.

Summarizing, is that feasible to get acticity events using a service principal created for the "embed content for your customers" case at all? I would like to have acccess to that activity log from within an application (backend).

Best reagrds,
Michal

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

sjkpdk — Fri, 19 Mar 2021 16:22:53 GMT

We are also unable to get this to work. It is really fustrating when the docs state that it should work for a service principal, but in reality it doesnt seem to be the case.

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

SteveAtCity — Fri, 16 Apr 2021 13:53:30 GMT

I am seeing the same issue as @micpo and @sjkpdk when trying to use the activityevents API from Azure Data Factory.

@V-lianl-msft :

Has anyone been able to get this method to work?

If not can what alternatives are there to extract power bi audit log activity?

What does the documentation mean by

" The user must have administrator rights . . . to call this API or authenticate via service principal."
"Required scope: Tenant.Read.All or Tenant.ReadWrite.All."

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

PowerMS — Sun, 07 Nov 2021 22:33:44 GMT

Hi,

I'm facing the same issue with the API https://api.powerbi.com/v1.0/myorg/admin/activityevents

1- I have created an app registration with the API permissions :

Tenant.Read.All

Tenant.ReadWrite.All

3-created Security Group in Azure Active Directory with the role "Power BI administrator "

4- Added the app to the Security group

5-Add the security group to the Admin API tenant setting in the Power BI admin portal

and I'm still having the error message "{"Message":"API is not accessible for application"}"

Any help please ?

Regards,

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

shubh43 — Tue, 25 Jan 2022 08:30:58 GMT

The URL in the Microsoft API documentation is wrong for service principals.

You need to also include the workspace ID in the URL, see below

https://api.powerbi.com/v1.0/myorg/groups/{WorkspaceID}/admin/activityevents )

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

micpol — Mon, 31 Jan 2022 21:52:54 GMT

HI Shubh43,

thanks for your reply.

I gave a try to that URL with a valid workspace ID, unfortunatlly it returned a 404 error.

Where did you get this URL from? Is it anywhere documented?

Best reagards,

Michal

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

Azure_newbie — Tue, 28 May 2024 14:25:18 GMT

Did you get that resolved? It is 2024 and it is still not easy to set it up.

Microsoft should really clarify their documentation.

Re: Power BI REST API - retrieving activity events returns 403 / "API is not accessible for app

Jithendra-Vetup — Fri, 31 Jan 2025 15:04:55 GMT

Hi @Azure_newbie

I know it might seem super counterintuitive, but here's what you need to do: remove all API privileges for the service principal. Azure somehow associates the role within the token, and that’s the issue.

To troubleshoot, double-check your token using this tool.

Here’s the step-by-step process to resolve the issue:

Remove all privileges for the service principal.
Add the service principal to a new security group.
Go to the Power Admin portal -> Tenant Settings -> Admin API Settings, and add the newly created security group there.

This should resolve the issue.

Cheers !