topic Re: Datasets - Execute Queries In Group in Developer

Datasets - Execute Queries In Group

Anonymous — Wed, 23 Aug 2023 17:51:20 GMT

Hi,

Trying to use API REST CALL with service principal - Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

Since service principals cannot be added to RLS role this for reports with RLS turned on the SP needs to impersonate the user having relevant RLS role.

And now the issue: does the impersonated user need to have rights to use rest api call (SP has such rights in my setup)? I get 401 error for datasets with RLS but for datasets with no RLS all is working as the impersonation is ignored.

thx,

Re: Datasets - Execute Queries In Group

lbendlin — Thu, 24 Aug 2023 23:14:24 GMT

Limitations

Datasets that are hosted in Azure Analysis Services or that have a live connection to an on-premises Azure Analysis Services model aren't supported.
The tenant setting Dataset Execute Queries REST API, found under Integration settings, must be enabled.
One query per API call.
One table request per query.
Maximum of 100,000 rows or 1,000,000 values per query (whichever is hit first). For example if you query for 5 columns, you can get back max 100,000 rows. If you query for 20 columns, you can get back max 50,000 rows (1 million divided by 20).
Maximum of 15MB of data per query. Once 15MB is exceeded, the current row will be completed but no additional rows will be written.
There's a limit of 120 query requests per minute per user, regardless of the dataset that's queried.
Service Principals aren't supported for datasets with RLS per RLS limitations or with SSO enabled. To use Service Principals, make sure the admin tenant setting Allow service principals to use Power BI APIs under Developer settings is enabled.
Only DAX queries are supported at this time. MDX and DMV queries are not supported.

Re: Datasets - Execute Queries In Group

Anonymous — Tue, 29 Aug 2023 07:59:41 GMT

I know the limitation listed above and this is not answering the question.

"Allow service principals to use Power BI APIs" - This option is enabled in my case for given SP
Its true that RLS does not support SP (You can't add it to any RLS role) but the API call I'm refering do have an user impersonation option: "The UPN of a user to be impersonated. If the model is not RLS enabled, this will be ignored."

So what is the behaviour MS designed?
dataset with no RLS + SP used + no impersonation - this works (impersonation if provided is ignored)
dataset with RLS + SP used + impersonated user with RLS role assigned- this doesn't work. Will it work if the impersonated user will be granted the privilege to query Power BI API?

Re: Datasets - Execute Queries In Group

Anonymous — Fri, 29 Sep 2023 13:15:34 GMT

I get the limitation, but in this case for what there is imparsonation field in body of the request ?

Re: Datasets - Execute Queries In Group

lbendlin — Fri, 29 Sep 2023 16:29:06 GMT

Can you confirm that the tenant admin enabled the setting?

Re: Datasets - Execute Queries In Group

Anonymous — Fri, 29 Sep 2023 16:40:23 GMT

Yes it is enabled for this service principal (not for all users)

Re: Datasets - Execute Queries In Group

Alic3Wonder — Mon, 24 Jun 2024 15:17:09 GMT

Hi, I am facing the same issue. Executing queries on a dataset without RLS works through Rest API, but as soon as I enable RLS and use impersonation I get the PowerBINotAuthorizedException.

It's a DirectLake dataset and the user that is being impersonated is a tech user with all rights granted to the dataset.

Is there any solution to this issue?

Re: Datasets - Execute Queries In Group

jaryszek — Mon, 22 Dec 2025 09:46:12 GMT

Anyone solved the case ?

Best,
Jacek