API - Service Principal - Profiles - Error 401

[Anonymous]

Hello,

As part of a POC, I am working on an application based on the use of the Power BI API to display graphs and allow their exploitation by users.
Machines push data via HTTP POST, and users can access the graphs after logging in.

My trial is currently based on the 60-day trial offer of Power BI.

The usage is not internal to my company, so I went with the "Embed for your customers (also known as app owns data)" scenario, and followed the following documentation in order to be able to separate the data from my customers:
https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-multi-tenancy

However, I can't push or even retrieve data when I use my token generated from the client-secret of my application, I have a 401 error.

Would you have an idea?

Sincerely,

[mshmordok · Accepted solution]

The push dataset API's are not supported for service principal profiles.
before using any of the API's with profile, you can check the permissions section in documention , it will be specified that the API can be called with service principal profile and a link to the documentation

Example : https://docs.microsoft.com/en-us/rest/api/power-bi/groups/add-group-user#permissions

[Anonymous]

Hi @Anonymous ,

The following ones are the threads which has the similar problem as yours, please review the solution in it. Hope they can also help you resolve the problem.

Unauthorized (401) Embedded using the samples Node and .NET

I found the problem. In case this happens to anybody, here's the solution:

The problem was in Step 7 - Enable workspace access that states Sign in to Power BI service > workspace you want to enable > Workspace access > Access pane, > copy the service principal to the Enter email address text box.

Because the email of the global admin was already filled out, I overlooked the actual requirement of entering the service principal ("Enter email address" was confusing).

The name of the service principal is the Display Name of the Azure AD app, as it appears in the Azure AD app's overview tab. This could also be a security group if you defined any.

---

Power Bi REST API - 401 Authorization error when using Service Principals

---

I made the Service Principal work in the "App Owns Data" demo and with the Rest APIs. It seems everything is set up correctly according to your description. Some suggestions are as follows.

1. Add the Service Principal as an admin in the workspace directly rather than add the security group. Please refer to article 5 in embed-service-principal#get-started-with-a-service-principal. We should use the Object ID.

2. The Service Principal inherit permission from the tenant rather than the Azure App permissions. 

>>>Service principals inherit the permissions for all Power BI tenant settings from their security group. To restrict permissions create a dedicated security group for service principals and add it to the 'Except specific security groups' list for the relevant, enabled Power BI settings.

3. I'm afraid you can't call the Admin REST API if the Service Principal doesn't have the permission.

---

Best Regards

[Anonymous]

Hi @Anonymous !

Thanks for your help 🙂

After a long time of trial and error, I finally figured out the problem, the URL to get my token was incorrect.

After configuring my application in Azure to be in "single tenant" mode and adding the tenant ID in the URL
https://login.microsoftonline.com/<tenantId>/oauth2/token

I was finally able to generate a token that was not denied when I wanted to create profiles and workspaces.

That said, I have not yet been able to create datasets...
I tried to make a post on a url of type:
"https://api.powerbi.com/v1.0/myorg/groups/<workspaceId>/datasets"
with an X-PowerBI-Profile-Id key in the header containing the ID of the created profile, and the following error is returned:

{
    "error": {
        "code": "InvalidRequest",
        "message": "Api isn't supported for profiles"
    }
}