Can't add dataset application perms for Power BI Azure integration?

[FabricUser101]

I'm trying to let a Service Principal account refresh my Power BI semantic model from a Python script. I've registered the app through Azure. I've done:

1. Added the Service Principal account to the workspace.
2. I've enabled Service Principals to use Fabric APIs and have been personally added to an included security group, though the Service Principal is not in one of those groups yet
3. I've tried doing enabling Service principals can access read-only admin APIs

But when I go to add API application permissions, I only see Tenant permissions. I can see the dataset ones for delegated permissions, but I need these for applications instead. Am I missing something besides adding the app to a security group?

[davidschiedam]

Does the solution above also work for executing queries on the data? I seem to be getting an 401 error when i want to evaluate tables. I did all of the above.

[V-yubandi-msft]

Hi @davidschiedam ,

The steps I mentioned earlier are mainly for refreshing a semantic model, while running queries against the dataset is a separate process.

If you’re seeing a 401 error when evaluating tables, it typically means the Service Principal lacks the necessary API permissions. For queries, you’ll need to assign the app Dataset.Read.All or Dataset.ReadWrite.All application permissions in Azure AD and ensure tenant admin consent is provided. Without these permissions, the token won’t include the required scopes for querying data.

Be sure to also check.

1. The Service Principal is added to the workspace with at least Contributor or Member access.

2. Authentication is done using the Service Principal’s client ID and secret/cert, rather than a user token.

3. Allow service principals to use Fabric APIs is enabled and the Service Principal is included in the allowed group.

With these settings in place, the Service Principal will be able to refresh and query datasets, and the 401 error should be resolved once the Dataset permissions are configured.

Please give it a try.

[davidschiedam]

Hey @V-yubandi-msft ,

Thanks for your reply. 

You state that I should assign the app (so PowerBI Service?) Dataset.Read.All (or ReadWrite.All) application permissions. But the problem is that these are not available. At least not as an application permission, but only as a delegated. That won't work with a Service Principal The only application-permissions are for tenants

Or is there any other way to add these app permissions, for example through PowerShell?

I get a bearer token with the Service Principal's client ID and secret, so no user token. 

Hope to hear from you!

[V-yubandi-msft]

Hi @davidschiedam ,

Thank you for clarifying. You are right Dataset.Read.All and Dataset.ReadWrite.All are available only as delegated permissions, not as application permissions, so they cannot be assigned to a service principal in Azure AD. For service principals, dataset query permissions are managed through workspace roles and the Fabric tenant setting.

To query tables, ensure your service principal is included in the allowed group for Allow service principals to use Fabric APIs and has at least Member or Contributor access in the workspace. Then, use the service principal token with the XMLA endpoint or Execute Queries API. No additional Azure AD application permission is needed. A 401 error usually indicates the service principal does not have dataset query rights in the workspace.

Hope this help....

[davidschiedam]

Hey @V-yubandi-msft ,

Tried all of the above. Could this be due to the fact that the underlying data is through Direct Query and my workspace doesn't have premium capacity? So changing the semantic data to Import Mode could be the solution.

Best,
David

[V-yubandi-msft]

Yes, that could very well be the reason. When a dataset is in DirectQuery mode and the workspace is not on Premium/Fabric capacity, a Service Principal won’t be able to run queries against it even if all the permissions are correctly set. This often results in the 401 error you're seeing.

DirectQuery datasets require Premium (F/P/PPU) capacity to allow Service Principals to query via API/XMLA.

If Premium isn’t available, switching the dataset to Import mode is a good workaround, because Import mode supports Service Principal queries even in non Premium workspaces.

So yes, changing it to Import mode or using a Premium workspace are both valid solutions.

-Yugandhar.

[FabricUser101]

Thank you @Akash_Varuna and @V-yubandi-msft ! Adding the service principal to a security group that was included in the allowed security groups was all I needed. I don't even need to select which API perms. 

[V-yubandi-msft · Accepted solution]

Hi @FabricUser101 ,

Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.

In addition to @Akash_Varuna & @tackytechtom  responses.

Since you’ve already enabled  Allow service principals to use Fabric APIs,  let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs  is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
 Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Mi...

You’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.

Roles in workspaces in Power BI - Power BI | Microsoft Learn

Regards,

Yugandhar.

[Akash_Varuna]

Hi @FabricUser101 Add the Service Principal to a security group with Power BI and Fabric API access. In Azure, grant application permissions for Power BI APIs, using Microsoft Graph if necessary. Enable Service Principal for APIs in Power BI Admin settings and include the security group. Finally, have an admin grant consent to the permissions in Azure.

[tackytechtom]

Hi @FabricUser101 ,

I happened to have written a couple of blog articles about refreshing semantic models, where the setup is also explained:
https://www.tackytech.blog/how-to-refresh-power-bi-datasets-from-data-factory-with-managed-identity/...

In the case above, we used a data factory pipeline that refreshed a semantic model via managed identity. However, the concept with security groups and allowing APIs and stuff, should be the same (see step 1 and 2).

Can you try it the way its explained in the blog article? If this does not work, can you provide some more information on from where you wanna do the refresh call e.g. is it a notebook inside fabric? Then you could use semantic-link for that.

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/