Microsoft Fabric GraphQL API returns 403 Forbidden - ServicePrincipalIsNotAllowedByTenantAdminSwitch

Hi,

Thanks for the details — good news is this isn't an issue with your setup. The fact that token generation worked fine with your Client ID/Secret/Tenant ID means your app registration is correct.

The ServicePrincipalIsNotAllowedByTenantAdminSwitch error just means your tenant admin hasn't flipped the switch yet that lets service principals call the Fabric APIs at all. It's a tenant-wide setting, not something on your end.

Here's what needs to happen:

Someone with tenant admin rights needs to go to the Power BI Admin Portal → Tenant settings → Developer settings, and turn on "Service principals can use Fabric APIs" (some tenants still show it as the older "Power BI APIs" wording). They can either enable it for the whole org, or restrict it to a specific security group — in which case your service principal needs to be added to that group.

A couple of things to keep in mind once that's turned on:

• It can take up to 15 mins (sometimes a bit longer) to actually kick in, so don't panic if it doesn't work instantly.
• Even after that setting is on, your service principal still needs to be added as a member/contributor on the actual workspace you're trying to hit — the tenant switch just opens the door, workspace permissions control what's actually inside.
• If you're calling the Fabric GraphQL API specifically (not the older Power BI REST API), double check there isn't a separate Fabric-specific toggle for it, since some tenants split these out.

   

  Hope this helps! A couple of quick asks if it does:

  • Drop a Kudos if this pointed you in the right direction
  • If it solves things, please mark it as the accepted solution — helps others hitting the same error find it faster
  • Also, come hang out on the Fabric Discord if you're not already there

    ugk161610,
    Proud Fabric Super User 🙂