Can't add dataset application perms for Power BI Azure integration?

[FabricUser101]

I'm trying to let a Service Principal account refresh my Power BI semantic model from a Python script. I've registered the app through Azure. I've done:

1. Added the Service Principal account to the workspace.
2. I've enabled Service Principals to use Fabric APIs and have been personally added to an included security group, though the Service Principal is not in one of those groups yet
3. I've tried doing enabling Service principals can access read-only admin APIs

But when I go to add API application permissions, I only see Tenant permissions. I can see the dataset ones for delegated permissions, but I need these for applications instead. Am I missing something besides adding the app to a security group?

[FabricUser101]

Thank you @Akash_Varuna and @V-yubandi-msft ! Adding the service principal to a security group that was included in the allowed security groups was all I needed. I don't even need to select which API perms. 

[V-yubandi-msft · Accepted solution]

Hi @FabricUser101 ,

Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.

In addition to @Akash_Varuna & @tackytechtom  responses.

Since you’ve already enabled  Allow service principals to use Fabric APIs,  let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs  is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
 Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Mi...

You’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.

Roles in workspaces in Power BI - Power BI | Microsoft Learn

Regards,

Yugandhar.

[Akash_Varuna]

Hi @FabricUser101 Add the Service Principal to a security group with Power BI and Fabric API access. In Azure, grant application permissions for Power BI APIs, using Microsoft Graph if necessary. Enable Service Principal for APIs in Power BI Admin settings and include the security group. Finally, have an admin grant consent to the permissions in Azure.

[tackytechtom]

Hi @FabricUser101 ,

I happened to have written a couple of blog articles about refreshing semantic models, where the setup is also explained:
https://www.tackytech.blog/how-to-refresh-power-bi-datasets-from-data-factory-with-managed-identity/...

In the case above, we used a data factory pipeline that refreshed a semantic model via managed identity. However, the concept with security groups and allowing APIs and stuff, should be the same (see step 1 and 2).

Can you try it the way its explained in the blog article? If this does not work, can you provide some more information on from where you wanna do the refresh call e.g. is it a notebook inside fabric? Then you could use semantic-link for that.

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/