Forum Discussion
Power BI REST API using Service Principal
Hi Anonymous ,
Thanks for reaching out to us with your problem. The 401 unauthorized error typically indicates that you didn't have the sufficient privilege to access the resource. In order to make further troubleshooting and give you a suitable solution, could you please provide the following info? It would be helpful to find the solution. Thank you.
- Tenant settings: Make sure "Allow service principals to use read-only Power BI admin APIs" is enabled.
- Workspace access: Add the service principal(the Display Name of the Azure AD app) as the admin of workspace. If service principal is in security group, please also add this service principal as the admin of workspace.
powerbi - Unauthorized (401) Power BI Embedded using the samples Node and .NET - Stack Overflow
- Check Token Acquisition: Verify that the 'scope' parameter in your POST request is set correctly. For Power BI, it should be 'https://graph.microsoft.com/.default'. - Ensure that the 'grant_type' is set to 'client_credentials'.
- Use the Token Correctly: When you paste the bearer token into the Authorization section of the GET request, ensure that there are no leading or trailing spaces. - Confirm that the token has not expired. Tokens typically have a 1-hour lifespan.
- Test the API Call: Use the same GET request that worked in the MS sandbox, but replace the bearer token with the one obtained through the Service Principal.
In addtion, the following ones are the threads which has the similar problem as yours. Hope they can help you.
Solved: Power Bi REST API - 401 Authorization error when u... - Microsoft Fabric Community
Solved: Power Bi REST API - 401 Authorization error when u... - Microsoft Fabric Community
Best Regards
Hi v-yiruan-msft ,
Thanks for getting back to me.
I'll run through your suggestion points one-by-one:
• Tenant settings - The service principal has been given all the necessary permissions by the admin in Azure
• Workspace access - This has caused us a little confusion as the GET request we're dealing with operates on a tenant-level, bringing back all workspaces. Would we still need to give the service principal admin access to every workspace? Seems like overkill..
• Token acquisition - I was initially using a different URL for the scope parameter, 'https://analysis.windows.net/powerbi/api/.default'. Changing this to the URL you've suggested has made a difference, so I'll go into more detail below
• Using the token correctly - I can confirm that this wouldn't be the cause of our issue, we were quite diligent on this point
• Testing the API call - The GET request we've been calling is to return the workspaces in our tenant, and I can confirm this works fine in MS sandbox, and also in Sandman where we used the same bearer token produced in MS sandbox as a test, so no problems there.
Note:
The only aspect I've changed is updating the URL for the scope parameter, along the lines of what you've suggested. This has brought back a 403 Forbidden error as opposed to the 401 Authorization error from before. I've researched the error and tried a few different params but can't am still coming back with 403s.
If there's something more I should be doing please let me know!
Thanks for your help,
Shane
I’m having exactly the same problem. I’m already going crazy!
It work only user functions, but when i use an admin function, i got the 401 error.
I resolved!
I leave just the permission Tenant.ReadWrite.All (Type delegated) on power bi service and remove all the others.
Also on admin portal power bi, i allowed app embed to my security group. Now, its working.
Hi MonicaGastalho Anonymous
Are you willing to share your Postman collection with me? Because I am getting stuck everytime connecting through Service Principal, drives me crazy.
