Service Principal for Semantic model Refresh Issue

[JibinSebastian]

Hi All,
We are trying to set up a service principal for semantic model refresh. We have created the service principal ID, a security group, and added the service principal to all the required workspaces.

However, when we try to create a new connection for the semantic model to the Gold Fabric Warehouse using the service principal, we encounter the following error:

“Unable to create connection for the following reason: It looks like the refresh token expired. Please go to this dataset’s settings page and re-enter the credentials for the data source.”

Are we missing something in the setup?

Specifically, what value should be provided in the Service Principal ID field?

Could someone help me understand the correct way to configure this? I am new to Fabric and currently managing Fabric on my own in the organization. We do have a tenant admin who has already created the service principal.

[v-aatheeque]

Hi @JibinSebastian 

Following up to confirm if the earlier responses addressed your query. If not, please share your questions and we’ll assist further.

[Ray_Minds]

Answer : 

1. Azure AD / Entra ID setup

App Registration should be have configure like below bcz its most confusing part which we need to make sure for correct way

Application (client) ID = Service Principal ID

Directory (tenant) ID = Tenant ID

Client Secret = use the secret VALUE, not the secret ID

Note : Allow Power Bi Api read-Write permission to this service Principal

2. Now we have to make some Tenant setting changes in Power Bi service

* Fabric / Power BI tenant admin must enable:

* Allow service principals to use Fabric / Power BI APIs

Steps:

1) Power BI Admin Portal

2) Tenant settings

3) Developer settings

4) Allow service principals to use Power BI APIs

Note : If this is disabled, service principal auth will always fail.

3. Workspace permissions in Power Bi Service :-

The service principal must be added to the workspace as Contributor (minimum) Or Member or Admin but not Read because it won't work to refresh the Datasets

[ssrithar]

Hi @JibinSebastian ,

Please find the steps to Fix the issue

1. Recreate the connection:

   • Go to the workspace → Create new connection

   • Use:

     • Tenant ID = Directory ID

     • Service Principal ID = Application (Client) ID

     • Service Principal Key = Client secret value

2. Verify permissions:

   • The SP must be assigned to the workspace (Contributor or Member role)

   • Ensure the SP is allowed under tenant settings:
     Admin portal → Tenant settings → Service principals

3. Use the SP to bind the semantic model:

   • When using the SP for scheduled refresh, make sure it’s added as a Gateway Connection credential (if applicable).

---

If everything is configured correctly and the token issue persists, you might also want to:

• Generate a new client secret

• Clear and reconfigure the connection using updated credentials

If this post helps, then please appreciate giving a Kudos or accepting as a Solution to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

[deborshi_nag]

Hi @JibinSebastian 

You would have to enter the Application (Client) ID of the Azure AD app registration you created (not the object ID).
This is exactly what “Service principal ID” refers to in the UI. 

So you should have:

• Tenant ID = Directory ID from Azure AD
• Service Principal ID = Application (Client) ID
• Service Principal Key = the client secret under Certificates & secrets

Your tenant admin who has created the service pricipal SPN for you should have shared the client secret already. 

Hope this helps - please appreciate by leaving a Kudos or accepting as a Solution!