Forum Discussion
Automated data-quality checks on Power BI semantic models using service principal
Thank you, this pointed me in the right direction.
I tested this further. I ran the simplest possible ExecuteQueries request:
EVALUATE ROW("Test", 1)
It still returned PowerBINotAuthorizedException on the affected semantic model, so the request was being blocked before any table/query logic was evaluated.
I then found that the model had a role defined in Manage roles. There were no members assigned to the role in Power BI Service, but the role definition still existed in the model.
As a test, I removed the role from the model and reran the same ExecuteQueries request with the service principal. After removing the role, the request worked.
Workspace Admin alone is not enough when the semantic model has RLS. For executeQueries the service principal is treated as its own identity, so it either needs to be a member of an RLS role on the model, or you pass an effectiveIdentity in the request body to impersonate a user in a role. Without one of those you will get PowerBINotAuthorizedException even with Admin on the workspace.
There is also a tenant level switch that catches a lot of people here. In the Fabric admin portal under Tenant settings, enable "Dataset Execute Queries REST API" for the security group that contains your service principal. It is separate from the general "Allow service principals to use Fabric APIs" setting and is required for executeQueries specifically.
For a daily data quality workflow I usually create a dedicated monitoring role in the semantic model with no table filters (so it returns all rows) and add only the SP to that role. That way your checks see the full data without changing the RLS used by end users.
If both pieces are in place, the same curl request will start returning results.
If this helped, a thumbs up and accepting the solution would be appreciated.
Best,
Shai Karmani
Thank you, this pointed me in the right direction.
I tested this further. I ran the simplest possible ExecuteQueries request:
EVALUATE ROW("Test", 1)
It still returned PowerBINotAuthorizedException on the affected semantic model, so the request was being blocked before any table/query logic was evaluated.
I then found that the model had a role defined in Manage roles. There were no members assigned to the role in Power BI Service, but the role definition still existed in the model.
As a test, I removed the role from the model and reran the same ExecuteQueries request with the service principal. After removing the role, the request worked.