Gateway cluster API call error

[BindiyaThota]

Hi,

I am trying to call below API through service principal and it is running into 401 error.

"https"//api.powerbi.com/v2.0/myorg/gatewayClusters?$expand=memberGateways"

Service principal is added to a group. I ensured that the group is given admin access to the gateway cluster.

Also ensured the same group is enabled for below tenant settings.

1. Service principals can acess read only admin APIs

2. Service principals can access admin APIs used for updates

What else is the service principal missing?

Appreciate any suggestions. Thanks!

[v-echaithra]

Hi @BindiyaThota ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-echaithra]

Hi @BindiyaThota ,

Just following up to see if the response provided was helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.

Best regards,
Chaithra E.

[v-echaithra · Accepted solution]

Hi @BindiyaThota ,

A 401 Unauthorized error when calling the Power BI Gateway Cluster Admin API through a service principal usually indicates a configuration issue in either Azure AD or the Power BI Admin Portal. Remove any admin-consent-required AAD app permissions from the app registration and then request a new token. Ensure service principal access is enabled in Power BI tenant settings.

In Power BI Admin Portal > Tenant Settings > Developer Settings:

Allow service principals to use Power BI APIs

Allow service principals to access admin APIs

If these settings are restricted to specific security groups, make sure your service principal is included.

Try to add the service principal itself as a Gateway Cluster Admin in Power BI > Manage Gateways.

Hope this helps.
Thank you.

[grazitti_sapna]

Hi @BindiyaThota 

Check that the service principal is directly assigned as a gateway cluster admin not just through a group assignment because some admin API endpoints require direct assignment. Also, verify that no admin-consent-required API permissions (like Dataset.ReadWrite.All or Tenant.Read.All) are enabled on your app registration, service principal authentication for admin APIs can fail with 401 if these permissions are present. Remove those permissions, refresh your token and try the call again

🌟 I hope this solution helps you unlock your Power BI potential! If you found it helpful, click 'Mark as Solution' to guide others toward the answers they need.

💡 Love the effort? Drop the kudos! Your appreciation fuels community spirit and innovation.

🎖 As a proud SuperUser and Microsoft Partner, we’re here to empower your data journey and the Power BI Community at large.

🔗 Curious to explore more? [Discover here].

Let’s keep building smarter solutions together!

[BindiyaThota]

Thank you for the suggestion, @grazitti_sapna .

I tried adding service principal as admin directly to the gateway cluster. But it did not help.

In the API permissions, I see permission (type=application) for "Tenant.Read.All" with admin consent to "Yes". Should this be changed to "No"?