403 error on API through ADF

[arjan901]

Hi Everyone,

I created an ADF pipeline to extract the user activity from the Power BI API. I've installed this at a dozen customers but now i have one customer where it won't work and i don't know why.

I set it up as follows

1. Creating an Azure Security Group (SG-Power-BI-API)
2. Added the Azure DataFactory as a member to that security group
3. Adding the security group to the Power BI Admin portal 'Allow service principals to user Power BI API's'
4. Created a linked server in the ADF
   

But i keep getting the following error message, what is going wrong? since i did this already a coupole of times without isses

ErrorCode=RestCallFailedWithClientError,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Rest call failed with client error, status code 403 Forbidden, please check your activity settings. Request URL: https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2022-11-19T00:00:00.000Z'&end...'. Response: {"Message":"API is not accessible for application"},Source=Microsoft.DataTransfer.ClientLibrary,'

[AmosHersch]

Hi @arjan901 ,

The only reason I can think of is related to step 3, you allow service principals from the security group to call user APIs, but the API you're trying to call is an admin API. There's a different tenant level switch to allow service principals to call admin APIs. Did you also allow the same security group to call admin APIs?

Enable service principal authentication for read-only admin APIs - Power BI | Microsoft Learn