401 Unauthorized When Calling Power BI Cloud Gateway REST API with Service Principle

[KhadarA]

Hi Power BI Community,

I'm encountering an issue that began recently and would appreciate some insights.

 What I'm Doing

I'm automating the deployment of Power BI reports (.pbix files) across multiple environments – Dev, QA, and Prod – using PowerShell. Here's what the script does:

1. Authenticates with Power BI using a Service Principal.
2. Publishes .pbix reports to a specified workspace.
3. Updates the dataset connection details (server/database/credentials).
4. Binds the dataset to a cloud gateway connection (configured in Settings > Manage Connections and Gateways).
5. Refreshes the dataset to complete deployment.

This process worked perfectly for the last 8–9 months.

Problem

Suddenly, starting June 2025, I'm getting a 401 Unauthorized error when calling the following API:

bash

CopyEdit

$apiUrl1 = "https://api.powerbi.com/v2.0/myorg/me/gatewayClusterDatasources?$expand=users"

$response12 = Invoke-PowerBIRestMethod -Url $apiUrl1 -Method Get

This was used to get the cloud gateway datasources, especially those created via "Manage Connections and Gateways" in the Power BI Service.

This API used to work with the service principal authentication – but now fails with a 401.

 What I Tried

1. Used Get-GatewayDatasource PowerShell cmdlet
   Ref: https://learn.microsoft.com/en-us/powershell/module/datagateway/get-datagatewaydatasource
   🔹 This does not support service principals, as confirmed by the error and documentation.
2. Used alternate REST APIs:
• Gateways - Get Gateways
  Ref: https://learn.microsoft.com/en-us/rest/api/power-bi/gateways/getgateways
• Gateways - Get Datasources
  Ref: https://learn.microsoft.com/en-us/rest/api/power-bi/gateways/getdatasources
  🔹 These APIs work only for On-Premises gateways, not the cloud gateways I’m using.
  🔹 Even with correct IDs, I still get 401 Unauthorized.
3. Admin API Access in Power BI Admin Portal
• Enabled Read-only access to Admin APIs for the service principal.
• Still no luck.

 What I'm Looking For

• Has Microsoft deprecated or restricted the https://api.powerbi.com/v2.0/myorg/me/gatewayClusterDatasources endpoint?
• Is there a new API to access cloud gateway datasources programmatically?
• Has anyone faced a similar 401 issue recently (June 2025 onwards)?
• Any ideas on alternative approaches to list and match cloud gateway datasource names by script?

 Auth Details

• Using Connect-PowerBIServiceAccount -ServicePrincipal -Credential ... -Tenant ...
• App has Dataset.ReadWrite.All and Gateway.Read.All permissions (confirmed).
• App is admin-consented.

Any guidance or updated documentation references would be incredibly helpful!

Thanks in advance,
Khadar Afghan

[v-sdhruv]

Hi @KhadarA ,

Sorry that you are still facing the issue-
Try to add the Service Principal as an admin in the workspace directly rather than adding the security group, and use  Object ID. 
Refer-

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal?tabs=azure-por...

I'm afraid you can't call the Admin REST API if the Service Principal doesn't have the permission.
Also check-

If you are still facing the issue, let me know, we can help you with raising a Support Ticket.
Hope this helps!

[KhadarA]

Still this issue is not resolved, any help would be appriciated. 

[v-sdhruv]

Hi @KhadarA ,

Maybe you can have a look at the similar issue here which was resolved.
Power Bi REST API - 401 Authorization error when using Service Principals.
If you are still getting the error, please consider raising a support ticket for further assistance.

To raise a support ticket for Fabric and Power BI, kindly follow the steps outlined in the following guide:

How to create a Support Ticket

If this post helps, please  Accept as solution to assist other members in finding it more easily.
Thank you for being a part of Microsoft Fabric Community Forum!

[v-sdhruv]

Hi @KhadarA ,

Thank you for providing such detailed write-up about your issue.
You can follow these checks to troubleshoot the problem-

1.Microsoft introduced a setting in the Power BI Admin Portal to allow service principals to use read-only admin APIs. This setting must be enabled to grant the necessary permissions. However, this setting is typically accessible only to users with administrative roles, such as Global Administrators or Power BI Service Administrators. If your account lacks these privileges, you might not be able to enable this setting yourself.

Check - Enable service principal authentication for admin APIs

2. Even after enabling the setting, it's crucial to ensure that the service principal has the appropriate permissions. Assigning permissions like Tenant.Read.All directly to the service principal in Azure AD is not recommended. Instead, permissions should be managed through the Power BI Admin Portal, where you can assign the service principal to specific security groups that have the necessary access rights.

3. The service principal needs to be explicitly granted access to the workspaces where the cloud gateway datasources are configured. It's essential to verify that the service principal has the necessary access to the specific resources you're trying to interact with.
Also check- https://community.fabric.microsoft.com/t5/Developer/Service-principals-can-access-admin-APIs-used-fo...

If you still face the issue, le me know I can help you with raising a Support ticket for that.

Hope this helps!
If the response has addressed your query, please Accept it as a solution so other members can easily find it.
Thank You!

[KhadarA]

Hi @v-sdhruv , 

Thank you for providing the instructions. I have confirmed all the above steps you have mentioned, below i will provide you all the screenshots.

I have added all my App registration in a security group. and given permission to the security group in admin portal.

This is the cloud connection and i have given permission to the App through which iam calling the api.
This is the cloud gateway dataset connection. i have given owner access to the app which is calling the api.
I have given access to the same app to my workspace where iam publising the report.