ADMIN Rest API request using Service Principal

[Anonymous]

Hi all, 

I am trying to use ADMIN REST API for Power BI (e.g., GetGroupsAsAdmin) using a Service Principal (Read-Only). 

I have follow the MS documentation for this process: 

1. Create App in Azure (Without any PBI Admin-consent credential)

2. Add the App into a Secure Group in Azure

3. Enable the Service Principal in Power BI and add the Secure Group as an specific group

4. Add the App as a member of the workspaces in Power BI Service

Then I generate the access token in PowerShell and try to pull out data from REST API using Anonynous connection in Power BI Desktop.

Yet I was getting a forbidden access message...

Then we allow the Delegated Permission (Tenant.ReadAll) but message just changed to "Credential provided are not valid"

Does anyone know what could be happening?

Many thanks

[Anonymous]

Hi @Anonymous,

Did the above suggestions help with your scenario? if that is the case, you can consider Kudo or Accept the helpful suggestions to help others who faced similar requirements.

If these also don't help, please share more detailed information to help us clarify your scenario to test.

How to Get Your Question Answered Quickly 

Regards,

Xiaoxin Sheng

[Daryl-Lynch-Bzy · Accepted solution]

Hi @Anonymous - you shouldn't need step 4.  The Service Principal app will be assigned premissions to read all workspaces when the Security Group it is a member of was added in step 3.  However, can I please check that you added it in the 2 places in the Power BI Tenant Settings:

1. Allow service principals to use Power BI APIs
2. Allow service principals to use read-only Power BI admin API

Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

Enable service principal authentication for read-only admin APIs - Power BI | Microsoft Learn