Forum Discussion
Can't add dataset application perms for Power BI Azure integration?
Hi FabricUser101 ,
Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.
In addition to Akash_Varuna & tackytechtom responses.
Since you’ve already enabled Allow service principals to use Fabric APIs, let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Microsoft LearnYou’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.
Roles in workspaces in Power BI - Power BI | Microsoft Learn
Regards,
Yugandhar.
Does the solution above also work for executing queries on the data? I seem to be getting an 401 error when i want to evaluate tables. I did all of the above.
V-yubandi-msftCommunity Support
Hi davidschiedam ,
The steps I mentioned earlier are mainly for refreshing a semantic model, while running queries against the dataset is a separate process.
If you’re seeing a 401 error when evaluating tables, it typically means the Service Principal lacks the necessary API permissions. For queries, you’ll need to assign the app Dataset.Read.All or Dataset.ReadWrite.All application permissions in Azure AD and ensure tenant admin consent is provided. Without these permissions, the token won’t include the required scopes for querying data.
Be sure to also check.
1. The Service Principal is added to the workspace with at least Contributor or Member access.
2. Authentication is done using the Service Principal’s client ID and secret/cert, rather than a user token.
3. Allow service principals to use Fabric APIs is enabled and the Service Principal is included in the allowed group.
With these settings in place, the Service Principal will be able to refresh and query datasets, and the 401 error should be resolved once the Dataset permissions are configured.
Please give it a try.
Hey V-yubandi-msft ,
Thanks for your reply.
You state that I should assign the app (so PowerBI Service?) Dataset.Read.All (or ReadWrite.All) application permissions. But the problem is that these are not available. At least not as an application permission, but only as a delegated. That won't work with a Service Principal The only application-permissions are for tenants
Or is there any other way to add these app permissions, for example through PowerShell?
I get a bearer token with the Service Principal's client ID and secret, so no user token.
Hope to hear from you!- V-yubandi-msft
Hi davidschiedam ,
Thank you for clarifying. You are right Dataset.Read.All and Dataset.ReadWrite.All are available only as delegated permissions, not as application permissions, so they cannot be assigned to a service principal in Azure AD. For service principals, dataset query permissions are managed through workspace roles and the Fabric tenant setting.
To query tables, ensure your service principal is included in the allowed group for Allow service principals to use Fabric APIs and has at least Member or Contributor access in the workspace. Then, use the service principal token with the XMLA endpoint or Execute Queries API. No additional Azure AD application permission is needed. A 401 error usually indicates the service principal does not have dataset query rights in the workspace.
Hope this help....