Datasets - Execute Queries In Group

[Anonymous]

Hi, 

Trying to use API REST CALL with service principal - Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

Since service principals cannot be added to RLS role this for reports with RLS turned on the SP needs to impersonate the user having relevant RLS role.

And now the issue: does the impersonated user need to have rights to use rest api call (SP has such rights in my setup)? I get 401 error for datasets with RLS but for datasets with no RLS all is working as the impersonation is ignored.  

thx, 

[jaryszek]

Anyone solved the case ?

Best,
Jacek 

[Anonymous]

Yes it is enabled for this service principal (not for all users)

[Anonymous]

I know the limitation listed above and this is not answering the question.

• "Allow service principals to use Power BI APIs" - This option is enabled in my case for given SP
• Its true that RLS does not support  SP (You can't add it to any RLS role) but the API call I'm refering do have an user impersonation option: "The UPN of a user to be impersonated. If the model is not RLS enabled, this will be ignored."

  
  So what is the behaviour MS designed?

• dataset with no RLS + SP used + no impersonation - this works (impersonation if provided is ignored)

• dataset with RLS + SP used + impersonated user with RLS role assigned- this doesn't work. Will it work if the impersonated user will be granted the privilege to query Power BI API? 

[Alic3Wonder]

Hi, I am facing the same issue. Executing queries on a dataset without RLS works through Rest API, but as soon as I enable RLS and use impersonation I get the PowerBINotAuthorizedException. 

It's a DirectLake dataset and the user that is being impersonated is a tech user with all rights granted to the dataset. 

Is there any solution to this issue?

[lbendlin]

Limitations

• Datasets that are hosted in Azure Analysis Services or that have a live connection to an on-premises Azure Analysis Services model aren't supported.
• The tenant setting Dataset Execute Queries REST API, found under Integration settings, must be enabled.
• One query per API call.
• One table request per query.
• Maximum of 100,000 rows or 1,000,000 values per query (whichever is hit first). For example if you query for 5 columns, you can get back max 100,000 rows. If you query for 20 columns, you can get back max 50,000 rows (1 million divided by 20).
• Maximum of 15MB of data per query. Once 15MB is exceeded, the current row will be completed but no additional rows will be written.
• There's a limit of 120 query requests per minute per user, regardless of the dataset that's queried.
• Service Principals aren't supported for datasets with RLS per RLS limitations or with SSO enabled. To use Service Principals, make sure the admin tenant setting Allow service principals to use Power BI APIs under Developer settings is enabled.
• Only DAX queries are supported at this time. MDX and DMV queries are not supported.

[Anonymous]

I get the limitation, but in this case for what there is imparsonation field in body of the request ? 

[lbendlin]

Can you confirm that the tenant admin enabled the setting?