Adding AD Group to a workspace via API

[BoNDoK00]

I am trying to manage access to workspaces via API and AD (or AAD) Groups. I have a service principal with Tenant.ReadWrite.All permission granted

The service principal is not added to the workspace I try to modify.

Here is what I tried with no success:

Using PBI Cmdlets

1. Login to PBI Service using a service principal

$clientId = "XXX"
$tenantId =  "XXX"
$clientSecret =  "XXX"
$SecurePassword = ConvertTo-SecureString $clientSecret -Force -AsPlainText
$servicePrincipal = New-Object -TypeName PSCredential ($clientId, $SecurePassword)
Connect-PowerBIServiceAccount -ServicePrincipal -Credential $servicePrincipal -Environment Public -Tenant $tenantId

2. Use Cmdlets to add a group to a workspace

Add-PowerBIGroupUser  -Scope Individual -AccessRight Admin -PrincipalType Group -Id <WorkspaceID>  -Identifier <AD Group Object ID>

 3. I receive this error:

Add-PowerBIGroupUser : Operation returned an invalid status code 'NotFound'
At line:1 char:1
+ Add-PowerBIGroupUser  -Scope Individual -AccessRight Admin -Principal ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (Microsoft.Power...BIWorkspaceUser:AddPowerBIWorkspaceUser) [Add-PowerBIWorkspaceUser], HttpOperationException
    + FullyQualifiedErrorId : Operation returned an invalid status code 'NotFound',Microsoft.PowerBI.Commands.Workspaces.AddPowerBIWorkspaceUser

 4. I add the service principal to the workspace as an admin, then remove it 5 seocnds later, and I do the same call as in step 2, it works!

Any idea why? 

[Anonymous]

Hi @BoNDoK00,

Have you re-input the credentials for other API usages? AFAIK, when you work with 'Service Principal' mode, the credential seems only work for the current API and not been kept to quick verify other API. You need to manually input credentials before API usages every time.

Regards,

Xiaoxin Sheng