Forum Discussion
Issue with Accessing Power BI Admin APIs Using Service Principal (401 Error tryout mode)
Hi Venkatesh_ ,
This behaviour is actually expected in App Owns Data scenario. In this model, Power BI only sees the application or service principal, not your actual end users. Because of that, in Activity Logs you will see GUIDs instead of user email IDs, and there is no setting in Power BI to change this.To track real user activity, you need to handle it from your application side. Since your app already knows which user is logged in, you can use that information while generating the embed token. For example, when your backend calls the Generate Embed Token API, you can store details like user email, report ID, workspace ID, and timestamp in your database.
After that, on the frontend, you can use Power BI JavaScript SDK events (like report loaded, page changed, etc.) to capture how the user is using the report. These events can be sent back to your backend and stored along with the same user details. This way you can build your own complete usage tracking and audit report.
Also, even if you are using Effective Identity for RLS, that information is used only internally by Power BI for data filtering and will not come in Activity Logs as user email.
So overall, Activity Log is mainly for service-level auditing, not for detailed end-user tracking in embedded scenarios. For your requirement, maintaining logs in your application is the recommended approach.
Docs Reference
You can refer to below official Microsoft documentation:
Embed content in your Power BI embedded analytics application - Power BI | Microsoft Learn
Audit and usage admin settings - Microsoft Fabric | Microsoft Learn
Power BI embedded analytics Client APIs | Microsoft Learn
Thank you.
Hi Venkatesh_ ,
Based on your description, this does not seem to be an authentication issue, as the service principal is successfully obtaining a token and accessing the Groups API. The issue likely relates to permissions or configuration differences between standard Power BI APIs and Admin APIs. For Admin endpoints, the service principal must be enabled in the tenant settings and assigned the necessary tenant-level administrative privileges. Simply being an admin of individual workspaces is typically insufficient for Admin API access.
The Groups API returning only test or demo workspaces indicates the service principal may have access limited to those workspaces. Since the Groups endpoint lists workspaces available to the calling identity, please confirm that the service principal or its security group has access to the Dev and Prod workspaces as well.
I recommend reviewing Power BI tenant settings for service principal access, verifying administrative role assignments, and checking workspace permissions for the missing environments. If possible, please share the specific 401 error details and the Admin endpoint being used, as this information can help determine if the issue is related to tenant permissions or a particular API requirement.
Thank you.