Forum Discussion
Can't access PowerBI Admin APIs via Service Principal/ App Registration
Hi RuditMathews,
To sum up :
- Capacities & Groups → Fix by double-checking your tenant settings, SP should work
- Activity Events (most viewed, top users) → You do need a real user account, no workaround with SP
So you only need the real user account specifically for activity-based KPIs.
Memorable MemberHi RuditMathews,
Hope you are doing well!
The issue is that your Power BI Admin Activity Events API requires a different authentication approach than regular report-level APIs.
The Admin Activity Events API (/v1.0/myorg/admin/activityevents) does NOT support Service Principal authentication this is a known Microsoft limitation. Microsoft explicitly states that Activity Events require a delegated (user) authentication flow, not an application/service principal flow.
Looking at your permissions screenshot, your relevant permissions are:
Tenant.Read.All → Application type.
Tenant.ReadWrite.All → Application type.
However, for Activity Events specifically, even having these granted isn't enough when using a Service Principal.
Check Fabric Admin Settings again by making sure your security group is enabled under:
Fabric Admin Portal → Tenant Settings → "Allow service principals to use read-only admin APIs" ✅
AND "Enhance admin APIs responses with detailed metadata" ✅
Hope this helps. Feel free to ask me questions if needed, and don’t forget to like (kudos) & Accept as Solution if this guidance worked for you. That's motivate me to keep helping.
Best regards,
Oussama (Data Consultant & Fabric's Expert)
Hi oussamahaimoud ,
So you mean even if i give the below permissions I can access with Service principals? Or do you mean I need a delegated user account and then give the below permissions in the Fabric tenant settings?
If possible can you list necessary steps and permissions for me?
Check Fabric Admin Settings again by making sure your security group is enabled under:
Fabric Admin Portal → Tenant Settings → "Allow service principals to use read-only admin APIs"
AND "Enhance admin APIs responses with detailed metadata"
- oussamahaimoud
Hi RuditMathews,
Yes, with those two tenant settings enabled + your existing permissions, your SP can access most Admin APIs.
However, the /admin/activityevents endpoint will still return 401 — this is a Microsoft hard restriction that no permissions or settings can bypass.
Remember that for Activity Events, you must use a real user account (delegated auth) or switch to the Microsoft 365 Audit Log API instead.
Hi oussamahaimoud ,
Im getting 401 response for Activity events, Capacities, groups. So I'm trying to build a dashboard with KPIs like no. of users, most viewed dashboard, top users in a particular dashboard etc. So all the above APIs I can't access. So i'm assuming I should need a real user account for accessing the above endpoints for the mentioned KPIs.
- oussamahaimoud
Hi RuditMathews,
To sum up :
- Capacities & Groups → Fix by double-checking your tenant settings, SP should work
- Activity Events (most viewed, top users) → You do need a real user account, no workaround with SP
So you only need the real user account specifically for activity-based KPIs.