Access Denied for Power BI REST API Querying Dataset with Dataflows as Data Source

[Mosaic_pedro]

I'm trying to query a specific Power BI dataset using the REST API and a Python script with a service account for authentication. However, I'm encountering an "Access Denied" error for this particular dataset.

Dataset details: The dataset uses dataflows as its data sources apart from this, there is nothing special with it. The workspace is a fabric workspace (this one is currently on trial)

Service Account: The service account I'm using has the necessary permissions and works correctly for other datasets within the same tenant and workspaces.

Azure App Permissions: I have already confirmed that the Azure app used by the service account has been granted Dataset.ReadWrite.All access.

Debugging steps so far:

1. Queried other datasets within the same tenant using the same script and service account. No issues were encountered.
2. Verified that the service account has access to the dataset and related resources (dataflows).
3. Given these points, I suspect the issue might be related to how access tokens or permissions are configured for datasets that use dataflows as sources. Oddly when using dax studio or even Microsoft learn api explore with my user i get not issue.

My Questions

• Are there any special permissions or configurations required for service accounts to access datasets with dataflows as sources?

• Could this issue be related to the way access tokens are being validated for datasets with dataflows?

• What steps would you recommend to debug or resolve this access issue?

Any guidance or suggestions would be greatly appreciated!

Thank you for your time and help.

[Mosaic_pedro]

@lbendlin Thanks for you reply.

In fact scp is not in the token (i am comparing with the access token generated by microsoft learn for testing the api with my personal account). Not really sure how to fix it since i am already setting the scope 

https://analysis.windows.net/powerbi/api/.default when requesting the access token therefore, i can't find what i would need to change to fix it.

But assuming this would be the issue, it's hard to me the wrap my head around the fact that this same token can query other datasets from the same workspace and is even used to embed a report that uses this same dataset. Correct me if i am wrong, but user access is set at the workspace level right? So if this SA can access one should be able to have access to all.

Thanks for the help

[lbendlin]

Redo the app registration without delegating. 

[lbendlin]

Examine the token at jwt.io - most likely the scp is missing/wrong