Forum Discussion
Execute DAX via. app registration and Power BI Rest API
Hi KimTutein,
You're right in your understanding after assigning the Service Principal as an Admin on the workspace using the AddUserAsAdmin API, there is still one more step needed. You will also need to grant Build permissions on the specific dataset so that the Service Principal can access or create reports from it.
The correct API for this is the one that lets you assign dataset-level permissions specifically the Build permission. This is different from just being an Admin on the workspace, as dataset access needs to be granted separately.
You can find more details about this in the official Microsoft Learn page on semantic model (dataset) permissions here: Power BI REST APIs semantic model permissions – Microsoft Learn
If you are having trouble opening the link, I suggest trying a different browser or using incognito mode. Sometimes corporate networks or browser cache may cause issues with Learn pages.
Also, the general Power BI REST API overview page below can help if you're working on automation or embedding scenarios: Power BI REST APIs for embedded analytics and automation – Microsoft Learn
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
Hi KimTutein,
Thank you for the detailed follow-up and confirming the steps you have already taken that helps a lot.
Since you are still encountering the PowerBINotAuthorizedException despite correct tenant settings and admin rights, I recommend verifying a few additional things that often cause this issue:
- Tenant Setting API Access for Service Principals: Ensure that the "Allow service principals to use Power BI APIs" setting is enabled in the Power BI Admin portal. If it is scoped to security groups, please confirm that your service principal is part of an allowed group.
- Build Permission on Dataset: Even if the service principal is a Workspace Admin, please verify it has Build permissions on the specific dataset, especially when using the ExecuteQueries API.
- Check Dataset RLS or EffectiveIdentity: If your dataset uses Row-Level Security, ensure the SP is added to the role or that the EffectiveIdentity is used correctly when making the query.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
I now tried out a new app registration and sadly with the same result.
I have checked settings again and the only thing I cannot do is explicitly add build permission on dataset. It seems this cannot be done on an app registration – however the app registration is admin on the workspace so it should have all the permission it needs? However I tried explicit adding the security group with the app in it and giving it Build (and everyting else) - it says "all permissins granted - that did not help either.
So to sum up:
- Tennant settings
- “service principal can call Fabric public API’s” => enabled for entire organization
- “Semantic model execute queries REST API” => enabled for entire organization
- (“service principal can access read-only admin APIs”) => enabled for subset of the organization – this app is in the the security group
- API permission on the app
- Tenant.ReadWrite.All as “application” (with admin consent)
- Workspace permission
- App is admin (I cannot explicit set build permission but I would believe this should be included in workspace admin?). Explicit adding security group with the app in it with build permission did not help either.
- Model RLS
- We do not use RLS in any of our semantic models
- Access token
- I use this scope: "https://analysis.windows.net/powerbi/api/.default"
- I request token via. OAuth 2.0 via. : "https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
Hi KimTutein,
Thank you for testing with a new app registration and for sharing such a detailed summary that really helps narrow things down.
From what you have described, it sounds like most of the core tenant settings and permissions are correctly in place. However, one key detail stands out while your app registration is a Workspace Admin, it seems it does not have explicit Build permissions on the dataset.
This is a common point of confusion in the Power BI service, Service Principals (SPs) typically still require Build permission at the dataset level, even if they’re workspace admins. Unlike user accounts, this permission often does not come automatically and unfortunately, it can’t be added via the UI. It usually needs to be set programmatically.
This could explain why the API calls are failing the SP likely does not have the dataset-level access it needs to execute queries or perform related operations.
You might also consider reviewing the effective permissions the SP has on the dataset, just to confirm whether Build is being applied or not. That would help verify if this is indeed the missing piece.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.Hi
Thank you for your feedback.
Regarding permission it is very strange to me that Service Principle access does not follow the normal permission model in the UI (that is for instance an admin on workspace has build access on the semantic model) but I get that could explain it then. You say this must be added programmatically – could this be a REST API? I tried looking into Power BI Rest API Dataset – Put Dataset User in Group (Datasets - Put Dataset User In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn). However this API explicit says that “Updating permissions to service principals (app principalType) isn't supported”.
Can you elaborate on how you would set the build permission programmatically?
Hi KimTutein,
Thanks for the thoughtful follow-up and yes, you are right to question the behaviour. It does feel a bit counterintuitive that Service Principals, even as Workspace Admins, do not automatically get Build permissions on semantic models (datasets). But in practice, they do need that permission to be explicitly granted, and this has been a common stumbling block for many.
You're also right that the older Put Dataset User in Group API does not support App (Service Principal) as a principal type and that is why you are seeing that limitation noted in the documentation. Admin - Groups AddUserAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Admin - REST API (Power BI Power BI REST APIs) | Microsoft Learn
This API does support principalType = App, and it allows you to grant Build access to a dataset on behalf of a Service Principal, even though it can't be done from the UI.You would:
- Call this endpoint as a Power BI Service Admin.
- Use App as the principalType.
- Set datasetAccessRight to "Build".
This is the supported approach for assigning dataset-level access to Service Principals.
Power BI REST APIs semantic model permissions - Power BI | Microsoft Learn
Using AddUserAsAdmin with principalType: App is the right and currently supported method for enabling this scenario.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.