Forum Discussion
Execute DAX via. app registration and Power BI Rest API
Hi KimTutein,
You're right in your understanding after assigning the Service Principal as an Admin on the workspace using the AddUserAsAdmin API, there is still one more step needed. You will also need to grant Build permissions on the specific dataset so that the Service Principal can access or create reports from it.
The correct API for this is the one that lets you assign dataset-level permissions specifically the Build permission. This is different from just being an Admin on the workspace, as dataset access needs to be granted separately.
You can find more details about this in the official Microsoft Learn page on semantic model (dataset) permissions here: Power BI REST APIs semantic model permissions – Microsoft Learn
If you are having trouble opening the link, I suggest trying a different browser or using incognito mode. Sometimes corporate networks or browser cache may cause issues with Learn pages.
Also, the general Power BI REST API overview page below can help if you're working on automation or embedding scenarios: Power BI REST APIs for embedded analytics and automation – Microsoft Learn
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
Hi KimTutein,
Thank you for testing with a new app registration and for sharing such a detailed summary that really helps narrow things down.
From what you have described, it sounds like most of the core tenant settings and permissions are correctly in place. However, one key detail stands out while your app registration is a Workspace Admin, it seems it does not have explicit Build permissions on the dataset.
This is a common point of confusion in the Power BI service, Service Principals (SPs) typically still require Build permission at the dataset level, even if they’re workspace admins. Unlike user accounts, this permission often does not come automatically and unfortunately, it can’t be added via the UI. It usually needs to be set programmatically.
This could explain why the API calls are failing the SP likely does not have the dataset-level access it needs to execute queries or perform related operations.
You might also consider reviewing the effective permissions the SP has on the dataset, just to confirm whether Build is being applied or not. That would help verify if this is indeed the missing piece.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.
Hi
Thank you for your feedback.
Regarding permission it is very strange to me that Service Principle access does not follow the normal permission model in the UI (that is for instance an admin on workspace has build access on the semantic model) but I get that could explain it then. You say this must be added programmatically – could this be a REST API? I tried looking into Power BI Rest API Dataset – Put Dataset User in Group (Datasets - Put Dataset User In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn). However this API explicit says that “Updating permissions to service principals (app principalType) isn't supported”.
Can you elaborate on how you would set the build permission programmatically?
Hi KimTutein,
Thanks for the thoughtful follow-up and yes, you are right to question the behaviour. It does feel a bit counterintuitive that Service Principals, even as Workspace Admins, do not automatically get Build permissions on semantic models (datasets). But in practice, they do need that permission to be explicitly granted, and this has been a common stumbling block for many.
You're also right that the older Put Dataset User in Group API does not support App (Service Principal) as a principal type and that is why you are seeing that limitation noted in the documentation. Admin - Groups AddUserAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Admin - REST API (Power BI Power BI REST APIs) | Microsoft Learn
This API does support principalType = App, and it allows you to grant Build access to a dataset on behalf of a Service Principal, even though it can't be done from the UI.You would:
- Call this endpoint as a Power BI Service Admin.
- Use App as the principalType.
- Set datasetAccessRight to "Build".
This is the supported approach for assigning dataset-level access to Service Principals.
Power BI REST APIs semantic model permissions - Power BI | Microsoft Learn
Using AddUserAsAdmin with principalType: App is the right and currently supported method for enabling this scenario.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.I can use this api: Admin - Groups AddUserAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn to add the service principle to the workspace as admin (using the object id of the enterprise application (I allso see this reflected in the GUI).
The body is like this:
{
"groupUserAccessRight": "Admin",
"identifier": "[id of enterprise application]",
"principalType": "App"
}
If I understand you correct I then need to call another api to grant the service principle with “datasetAccessRight” to build. However you did not specify which api I should use for this (and the learn article reference reference the api that cannot be used with service principle)?
Hi KimTutein,
You're right in your understanding after assigning the Service Principal as an Admin on the workspace using the AddUserAsAdmin API, there is still one more step needed. You will also need to grant Build permissions on the specific dataset so that the Service Principal can access or create reports from it.
The correct API for this is the one that lets you assign dataset-level permissions specifically the Build permission. This is different from just being an Admin on the workspace, as dataset access needs to be granted separately.
You can find more details about this in the official Microsoft Learn page on semantic model (dataset) permissions here: Power BI REST APIs semantic model permissions – Microsoft Learn
If you are having trouble opening the link, I suggest trying a different browser or using incognito mode. Sometimes corporate networks or browser cache may cause issues with Learn pages.
Also, the general Power BI REST API overview page below can help if you're working on automation or embedding scenarios: Power BI REST APIs for embedded analytics and automation – Microsoft Learn
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.