Forum Discussion
Execute DAX via. app registration and Power BI Rest API
Hi KimTutein,
You're right in your understanding after assigning the Service Principal as an Admin on the workspace using the AddUserAsAdmin API, there is still one more step needed. You will also need to grant Build permissions on the specific dataset so that the Service Principal can access or create reports from it.
The correct API for this is the one that lets you assign dataset-level permissions specifically the Build permission. This is different from just being an Admin on the workspace, as dataset access needs to be granted separately.
You can find more details about this in the official Microsoft Learn page on semantic model (dataset) permissions here: Power BI REST APIs semantic model permissions – Microsoft Learn
If you are having trouble opening the link, I suggest trying a different browser or using incognito mode. Sometimes corporate networks or browser cache may cause issues with Learn pages.
Also, the general Power BI REST API overview page below can help if you're working on automation or embedding scenarios: Power BI REST APIs for embedded analytics and automation – Microsoft Learn
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
Hi KimTutein,
Thanks for raising your question. Based on your detailed explanation and the error message (PowerBINotAuthorizedException – 401), it appears that the issue stems from authentication using a service principal (app registration) with delegated permissions, which is not supported for the Execute Queries API when used outside a user context.
The ExecuteQueries REST API for Power BI requires proper authentication using a service principal with application permissions.
In your case, you're using delegated permissions (Dataset.ReadWrite.All), which only work in the context of a signed-in user. However, a service principal (client ID + secret) represents an application identity without a user context, so this approach leads to a 401 Unauthorized error.
Go to your app registration in Azure and: Remove the Delegated permission (Dataset.ReadWrite.All). Add the Application permission instead. Choose Dataset.Read.All or Dataset.ReadWrite.All under Application permissions. Don’t forget to click “Grant admin consent” after adding it. Configure a service principal to call Power BI APIs
Since you are using a service principal, you need to get the token using the client credentials flow (not a user-based flow). That means grant_type should be client_credentials. scope should be: https://analysis.windows.net/powerbi/api/.default
OAuth 2.0 client credentials flow
Double-check tenant settings: It is great that you have already enabled the right tenant settings! Just make sure: Allow service principals to use Power BI APIs is turned on. Semantic model Execute Queries REST API is enabled for the whole org.
Make sure the app is added to the workspace: Even if the app is set up correctly in Azure, it also needs to be added as a member or Admin in the Premium workspace where your semantic model lives. Workspace roles in Power BI
Let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
Just to let you know we tried
- adding Tenant.ReadWrite.All as “application” (as the Dataset.ReadWrite.All” was not a permission we could chose for application level).
- We are using the Oauth 2.0 client crededent flow via “https://analysis.windows.net/powerbi/api/.default”
- Double check the service principle we use is admin on the workspace with the smenatic model
The error is still:
Response status code: 401 {'error': {'code': 'PowerBINotAuthorizedException', 'pbi.error': {'code': 'PowerBINotAuthorizedException', 'details': [], 'exceptionCulprit': 1, 'parameters': {}}}}
Tenant settings:
Granted api permissions
Hi KimTutein,
Thank you for the detailed follow-up and confirming the steps you have already taken that helps a lot.
Since you are still encountering the PowerBINotAuthorizedException despite correct tenant settings and admin rights, I recommend verifying a few additional things that often cause this issue:
- Tenant Setting API Access for Service Principals: Ensure that the "Allow service principals to use Power BI APIs" setting is enabled in the Power BI Admin portal. If it is scoped to security groups, please confirm that your service principal is part of an allowed group.
- Build Permission on Dataset: Even if the service principal is a Workspace Admin, please verify it has Build permissions on the specific dataset, especially when using the ExecuteQueries API.
- Check Dataset RLS or EffectiveIdentity: If your dataset uses Row-Level Security, ensure the SP is added to the role or that the EffectiveIdentity is used correctly when making the query.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.I am in the process of getting a new app registration which "only" has the read/write tennant setting on app level. When I tried this on my "old" app we were no longer able to use the app for getting data on admin API's which we then needed to fix. I awaite new app and will test and let you know.
Thank you for all the feedback you have allready given to me.
I now tried out a new app registration and sadly with the same result.
I have checked settings again and the only thing I cannot do is explicitly add build permission on dataset. It seems this cannot be done on an app registration – however the app registration is admin on the workspace so it should have all the permission it needs? However I tried explicit adding the security group with the app in it and giving it Build (and everyting else) - it says "all permissins granted - that did not help either.
So to sum up:
- Tennant settings
- “service principal can call Fabric public API’s” => enabled for entire organization
- “Semantic model execute queries REST API” => enabled for entire organization
- (“service principal can access read-only admin APIs”) => enabled for subset of the organization – this app is in the the security group
- API permission on the app
- Tenant.ReadWrite.All as “application” (with admin consent)
- Workspace permission
- App is admin (I cannot explicit set build permission but I would believe this should be included in workspace admin?). Explicit adding security group with the app in it with build permission did not help either.
- Model RLS
- We do not use RLS in any of our semantic models
- Access token
- I use this scope: "https://analysis.windows.net/powerbi/api/.default"
- I request token via. OAuth 2.0 via. : "https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
Hi KimTutein,
Thank you for testing with a new app registration and for sharing such a detailed summary that really helps narrow things down.
From what you have described, it sounds like most of the core tenant settings and permissions are correctly in place. However, one key detail stands out while your app registration is a Workspace Admin, it seems it does not have explicit Build permissions on the dataset.
This is a common point of confusion in the Power BI service, Service Principals (SPs) typically still require Build permission at the dataset level, even if they’re workspace admins. Unlike user accounts, this permission often does not come automatically and unfortunately, it can’t be added via the UI. It usually needs to be set programmatically.
This could explain why the API calls are failing the SP likely does not have the dataset-level access it needs to execute queries or perform related operations.
You might also consider reviewing the effective permissions the SP has on the dataset, just to confirm whether Build is being applied or not. That would help verify if this is indeed the missing piece.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
- Tennant settings