Forum Discussion
Can't add dataset application perms for Power BI Azure integration?
Hi FabricUser101 ,
Thank you for reaching out. I understand you’re trying to refresh a Power BI semantic model using a Service Principal and a Python script, but you’re encountering issues because you can’t find the Dataset.ReadWrite.All application permission in Azure, and your script likely fails with a permissions error.
In addition to Akash_Varuna & tackytechtom responses.
Since you’ve already enabled Allow service principals to use Fabric APIs, let’s add your Service Principal to an allowed group. Confirm Allow service principals to use Fabric APIs is enabled, select Specific security groups, and add your PowerBI ServicePrincipals group.
Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Microsoft LearnYou’ve added the Service Principal to the workspace, but let's make sure it has the correct role. Verify that your Service Principal (its security group) has at least the Contributor role (Admin is also acceptable). This role allows it to refresh the semantic model.
Roles in workspaces in Power BI - Power BI | Microsoft Learn
Regards,
Yugandhar.
Hey V-yubandi-msft ,
Thanks for your reply.
You state that I should assign the app (so PowerBI Service?) Dataset.Read.All (or ReadWrite.All) application permissions. But the problem is that these are not available. At least not as an application permission, but only as a delegated. That won't work with a Service Principal The only application-permissions are for tenants
Or is there any other way to add these app permissions, for example through PowerShell?
I get a bearer token with the Service Principal's client ID and secret, so no user token.
Hope to hear from you!
Community SupportHi davidschiedam ,
Thank you for clarifying. You are right Dataset.Read.All and Dataset.ReadWrite.All are available only as delegated permissions, not as application permissions, so they cannot be assigned to a service principal in Azure AD. For service principals, dataset query permissions are managed through workspace roles and the Fabric tenant setting.
To query tables, ensure your service principal is included in the allowed group for Allow service principals to use Fabric APIs and has at least Member or Contributor access in the workspace. Then, use the service principal token with the XMLA endpoint or Execute Queries API. No additional Azure AD application permission is needed. A 401 error usually indicates the service principal does not have dataset query rights in the workspace.
Hope this help....
Hey V-yubandi-msft ,
Tried all of the above. Could this be due to the fact that the underlying data is through Direct Query and my workspace doesn't have premium capacity? So changing the semantic data to Import Mode could be the solution.Best,
David- V-yubandi-msft
Yes, that could very well be the reason. When a dataset is in DirectQuery mode and the workspace is not on Premium/Fabric capacity, a Service Principal won’t be able to run queries against it even if all the permissions are correctly set. This often results in the 401 error you're seeing.
DirectQuery datasets require Premium (F/P/PPU) capacity to allow Service Principals to query via API/XMLA.
If Premium isn’t available, switching the dataset to Import mode is a good workaround, because Import mode supports Service Principal queries even in non Premium workspaces.
So yes, changing it to Import mode or using a Premium workspace are both valid solutions.
-Yugandhar.