Error assigning premium capacity to workspace - PowerBINotAuthorizedException

[Shree007]

Hi all, 

I am encountering an error while attempting to assign premium capacity to the workspace in Power BI. I am using a service principal admin app with Python and REST API to create the workspace and then assign the capacity. However, when I try to assign the workspace, I receive the following error message:

{"error":{"code":"PowerBINotAuthorizedException","pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}}}.

I have already checked that I have the "Capacity.Readwrite.All" and "Workspace.ReadWrite.All" API permission, and the workspace is successfully created when I run the python script.

I suspect that there might be additional steps or permissions required to assign the workspace to the capacity. Any help or guidance on resolving this issue would be greatly appreciated.

Thank you 

Regards,

Shreenath 

@lbendlin @Greg_Deckler @Kaviraj11 @dm-p

Need Help guys

[Shree007 · Accepted solution]

@Greg_Deckler @Anonymous : Thank you all for the response. I have successfully resolved the issue by ensuring that the premium capacity had the necessary contributor permissions. After doing so, my Python code was able to assign the capacity. I would like to express my thank you to you both. 

Screenshot attached here : 

To assign the necessary permissions, go to Power BI Admin, navigate to Capacity, and select the Premium Capacity and then go to the Contributor option. In this step, make sure to specify the correct security group name, as we had security groups in place..

In the future, if anyone works with a Service Principal Admin, I would recommend considering this parameter as well.

Thank you! 

[Shree007]

Yes I can but in my code im using service principle to assign capacity.  This service principle has Capacity.Readwrite.All and Workspace.Readwrite.all API Permission and also it has been added to admin Security Groups. Im able to create Workspace using this service principle but not assign capacity. 

[Greg_Deckler]

 It seems from this that there is an a Capacity Assignment permission. It also specifies to use the service principal object ID: Move your Power BI embedded analytics app to production - Power BI | Microsoft Learn

Assign a workspace to a capacity by using a service principal
To assign a workspace to a capacity by using a service principal, use the Power BI REST API. When you're using the Power BI REST APIs, make sure to use the service principal object ID. The service principal should have administrator permissions for the workspace and capacity assignment permissions for the capacity.

@Shree007

[Shree007]

Hi @Greg_Deckler 

Thanks for your reply. I am using REST API to create workspace and assign capacities. As you have mentioned I have already added the service principal to my workspace (as admin). Regarding the service principal having permissions to assign capacity or not, how can I check this ? Where can I assign this permission ?

Thanks

[Greg_Deckler]

@Shree007 These are the instructions found here: Manage your Fabric capacity - Microsoft Fabric | Microsoft Learn

To add or remove admins in a Fabric capacity, follow these steps:

1. In the Capacity settings page, select Fabric Capacity.

2. From the list of capacities, select the capacity you want to make changes to.

3. In the capacity's setting page, from the Details tab, select expand Admin permissions.

4. Add or remove admins from the text box.

5. Select Apply.

To add or remove admins in a Power BI Premium capacity, follow these steps:

1. In the Capacity settings page, select Power BI Premium.

2. From the list of capacities, select the capacity you want to make changes to.

3. In the capacity's setting page, from the Details tab, select expand Admin permissions.

4. Add or remove admins from the text box.

5. Select Apply.

[Shree007]

@Greg_Deckler Hi, 

We have PowerBi Premium Capacity and I tried to add, but i'm unable to add a ServicePrinciple or a Security Group in there. looks like it works only for individual users. Do you know how to add a ServicePrinciple ? 

Thanks in advance.

[Anonymous]

Thanks for the reply from Greg_Deckler , please allow me to provide another insight:

Hi, @Shree007 

Regarding adding a service principal to a workspace, my solution is as follows:
First, if you're an administrator, check that your following switches are on:
 

Second, add normally:

You can also use PowerShell to add it, here's a screenshot of the official documentation for the content:

Here is the relevant documentation:

Embed Power BI content in an embedded analytics application with service principal and an applicatio...
Automate Power BI Premium workspace and semantic model tasks with service principals - Power BI | Mi...

Of course, if you have any new ideas, you are welcome to contact us.
 

Best Regards,

Leroy Lu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Shree007]

@Anonymous : Thank you for the reply. 
I had added service principal as admin to the workspace, and from what you mentioned above I have also enabled settings in the PowerBI Admin portal. 
However when I try to run this API call, I get this error -
"pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}

What am I missing ?

Thanks in advance !

[Anonymous]

HI,@Shree007 
Thanks for the quick reply.
 

Has the problem been solved? If it does, share your solution and accept it as a solution that will help other community members who have the same problem as you.

In response to your question, based on the information I've gathered, you can try the following:

1.First, you can try adding the service principal to the security group and then perform a similar operation on the security group to see if that solves the problem.

Here are screenshots and links to the relevant answers:
 

2.Second, you can try removing the permissions granted.

The access token is then decoded using a JWT token decoder to check for the presence of a key/value pair.
 

3.Finally, if the token still contains the value of the key/value pair, create a new app that doesn't have permissions and add it to an existing security group.
 

Here are screenshots and links to the relevant answers:

python - Power BI Rest API Requests Not Authorizing as expected - Stack Overflow
Of course, hopefully you will back up your important data before trying my advice to see if that solves the problem.

If you have any new ideas, you are welcome to contact us.
 

Best Regards,

Leroy Lu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Greg_Deckler]

@Shree007 First question I would have is whether or not you can go into the Service and manually assign the workspace to the premium capacity.

[Shree007]

@Greg_Deckler yes, am able to assign premium license capacity to a workspace from the PBI online service. Just doesn't work via the API call.