topic Re: Power BI API using Service Principal in Data Engineering

Power BI API using Service Principal

Anonymous — Thu, 17 Oct 2024 01:11:38 GMT

Hi, I am not sure if this is the right category to post since i am not a Fabric user but only Power BI. if not, my bad 😂

i am trying to use Power BI API via Service principal. i've given delegated permissions to the service principal and also enabled all the settings in Power BI's Admin Portal setting relevant. details as below:

- APIs

- Got my token as following to 'https://api.powerbi.com/v1.0/myorg/groups/{group_id}/datasets/{dataset_id}/refreshes' (get)

- Get Power BI Dataset Refresh history

: 'https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token' (post)

- GET Sharepoint Data

:' https://accounts.accesscontrol.windows.net/[Tenant-ID]/tokens/OAuth/2' (post)

- Power BI Workspace : Added a security group the service principal is in as Admin. in case it might help, i also added the service principal itself as admin, too...

- Delegated permission

- Dataset.readwrite.all

- Item.Excute.ALL

- Item.ExternalDataShare.ALL

- Item.ReadWrite.ALL

- Item.Reshare.ALL

-App.Read.All

- AllSites.Read

- AllSites.Write

The thing is that even all these settings added and enabled, i still get errors,,,, is anyone know how i can resolve this?

P.S. I succeeded testing the same senario in Different Tenant. therefore, it could be something to do with conditional access?

Regards,

Thank you.

Re: Power BI API using Service Principal

FabianSchut — Thu, 17 Oct 2024 05:24:54 GMT

Hi @Anonymous,

What method do you use to get the Bearer token? Do you use the client_id & client_secret version? What is the scope you are using while retrieving the Bearer token?

Re: Power BI API using Service Principal

frithjof_v — Thu, 17 Oct 2024 10:05:32 GMT

Just want to mention:

When you are using service principal (or more precisely: client credentials flow), the delegated permissions have no effect. So it's not necessary to setup any delegated permissions when you will use the service principal authentication (more specifically, client credentials flow).

What matters, is what permissions you give the service principal inside the Power BI portal (Fabric).

https://learn.microsoft.com/en-us/answers/questions/2039779/service-principal-doesnt-respect-delegated-permiss

https://community.fabric.microsoft.com/t5/General-Discussion/Power-BI-Rest-API-Delegated-permissions-vs-Service-principal/m-p/4133831

https://www.reddit.com/r/PowerBI/s/ZhJFNHA7vM

Re: Power BI API using Service Principal

Anonymous — Fri, 18 Oct 2024 00:23:16 GMT

Hi @FabianSchut,

The bearer token was obtained using the clien_sercet method. and I use scope 'https://analysis.windows.net/powerbi/api/.default'

Re: Power BI API using Service Principal

FabianSchut — Fri, 18 Oct 2024 05:11:20 GMT

Hi @Anonymous,

Those are indeed the correct settings. Are you sure that the service principal is added as a member in the security group app-test-mhkim (the security group that is able to use APIs)? And just to be sure, in your screenshot you have unapplied changes for the admin API settings. Did you apply them afterwards?

Re: Power BI API using Service Principal

Anonymous — Fri, 18 Oct 2024 09:21:36 GMT

Hi, @Anonymous

Thanks for the reply from FabianSchut and frithjof_v, FabianSchut gave the suggetions, you can check it.

Best Regards,
Yang
Community Support Team