Forum Discussion

RuditMathews's avatar
RuditMathews
New Member
3 months ago
Solved

Can't access PowerBI Admin APIs via Service Principal/ App Registration

 

Hello,

I'm trying to access powerbi admin apis, below are the permissions given to the SP.
I have created a security group and added my application in that security group and added that in fabric tenant settings to call the API. The report level api returns data, but admin activity event doesn't return anything other then 401.

Can someone guide on what am I missing

 

Need Help
  • oussamahaimoud's avatar
    oussamahaimoud
    3 months ago

    Hi RuditMathews,

     

    To sum up :

    • Capacities & Groups → Fix by double-checking your tenant settings, SP should work
    • Activity Events (most viewed, top users) → You do need a real user account, no workaround with SP

    So you only need the real user account specifically for activity-based KPIs.

9 Replies

  • v-achippa's avatar
    v-achippa
    Community Support
    3 months ago

    Hi RuditMathews,

     

    Thank you for reaching out to Microsoft Fabric Community.

     

    Here the regular api’s are already working with the Service Principal/ App Registration so the permissions look fine.

    Looks like here the issue is that the tenant setting specifically required for admin api is not enabled.

    • Please verify the below setting in the Fabric/Power BI Admin Portal:
      Go to the Admin Portal --> Tenant settings --> Admin API settings and enable ‘Allow service principals to use read-only admin APIs’.

    Also make sure this setting is applied to the security group where the App Registration was added. After enabling the setting, please wait a few minutes for propagation, generate a new access token and retry the activity events api.

     

    Thanks and regards,

    Anjan Kumar Chippa

  • RuditMathews's avatar
    RuditMathews
    New Member
    3 months ago

    Hi, v-achippa 
    The below part you mentioned I have already done. I have created the security group in azure portal and added that App registration in the security group. and readded the security group in Fabric. Still I'm getting a 401 response.


    Go to the Admin Portal --> Tenant settings --> Admin API settings and enable ‘Allow service principals to use read-only admin APIs’.

  • oussamahaimoud's avatar
    oussamahaimoud
    Memorable Member
    3 months ago

    Hi RuditMathews,

    Hope you are doing well!

     

    The issue is that your Power BI Admin Activity Events API requires a different authentication approach than regular report-level APIs.

     

    The Admin Activity Events API (/v1.0/myorg/admin/activityevents) does NOT support Service Principal authentication this is a known Microsoft limitation. Microsoft explicitly states that Activity Events require a delegated (user) authentication flow, not an application/service principal flow.

     

    Looking at your permissions screenshot, your relevant permissions are:

    Tenant.Read.All → Application type.

    Tenant.ReadWrite.All → Application type.

    However, for Activity Events specifically, even having these granted isn't enough when using a Service Principal.

     

    Check Fabric Admin Settings again by making sure your security group is enabled under:

    Fabric Admin Portal → Tenant Settings → "Allow service principals to use read-only admin APIs" ✅

    AND "Enhance admin APIs responses with detailed metadata" ✅

     

    Hope this helps. Feel free to ask me questions if needed, and don’t forget to like (kudos) & Accept as Solution if this guidance worked for you. That's motivate me to keep helping.

     

     

     

    Best regards,

     

    Oussama (Data Consultant & Fabric's Expert)

    • RuditMathews's avatar
      RuditMathews
      New Member
      3 months ago

      Hi oussamahaimoud ,

      So you mean even if i give the below permissions I can access with Service principals? Or do you mean I need a delegated user account and then give the below permissions in the Fabric tenant settings?

      If possible can you list necessary steps and permissions for me? 


      Check Fabric Admin Settings again by making sure your security group is enabled under:

      Fabric Admin Portal → Tenant Settings → "Allow service principals to use read-only admin APIs" 

       

      AND "Enhance admin APIs responses with detailed metadata" 

       

       

      • oussamahaimoud's avatar
        oussamahaimoud
        Memorable Member
        3 months ago

        Hi RuditMathews,

        Yes, with those two tenant settings enabled + your existing permissions, your SP can access most Admin APIs.

        However, the /admin/activityevents endpoint will still return 401 — this is a Microsoft hard restriction that no permissions or settings can bypass.

         

        Remember that for Activity Events, you must use a real user account (delegated auth) or switch to the Microsoft 365 Audit Log API instead.

  • v-achippa's avatar
    v-achippa
    Community Support
    3 months ago

    Hi RuditMathews,

     

    As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the user for the issue worked? or let us know if you need any further assistance.

     

    Thanks and regards,

    Anjan Kumar Chippa

    • v-achippa's avatar
      v-achippa
      Community Support
      3 months ago

      Hi @RuditMathews,

       

      We wanted to kindly follow up to check if the solution provided by the user for the issue worked? or let us know if you need any further assistance.

       

      Thanks and regards,

      Anjan Kumar Chippa