Get 401 Error when try to Get Activity Events (Audit Logs)

[VSmart]

I'm trying to get Power BI audit logs using service principal.

I follow every step in creating Azure principal Embed Power BI content in an embedded analytics application with service principal and an applicatio...

1.Create app

2.Create secret 

3. Add app into group 

4. Give all permitions to app 

Tenant.Read.All, Tenant.ReadWrite.All;Report.ReadWrite.All, Report.Read.All, Dataset.Read.All;Auditlog.Read.All; Workspace.Read.All;Workspace.ReadWrite.All; and many other permitions.

5. Enable "Allow service principal to use Power BI API's" and "Enable content in apps" in Power BI admin portal.

I can get acces token and run few API calls like : 

"https://api.powerbi.com/v1.0/myorg/groups" and 

"https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports"

But when try to get activity events

"https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2023-02-13T07:55:00.000Z'&end..." and 

"https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='" + activityDate + "T00:00:00'&endDateTime='" + activityDate + "T23:59:59'"

- get 401 error.

Or post this request "https://api.powerbi.com/v1.0/myorg/datasets/{datasetId}/refreshes" get 403 error.

My Python script is follow:

TENANT_ID = '1eb27ef3-976f-4600-a791-*******'
CLIENT_ID = 'd5376b05-a655-463b-ae9f-*******'
CLIENT_SECRET = '**************************'
SCOPE_BASE = ['https://analysis.windows.net/powerbi/api/.default']
AUTHORITY_URL = 'https://login.microsoftonline.com/organizations'
try:
    authority = AUTHORITY_URL.replace('organizations', TENANT_ID)
    clientapp = msal.ConfidentialClientApplication(CLIENT_ID, client_credential=CLIENT_SECRET, authority=authority)
    response = clientapp.acquire_token_for_client(scopes=SCOPE_BASE)
    try:
        access_token = response['access_token']
        activityDate = date.today() - timedelta(days=1)
        activityDate = activityDate.strftime("%Y-%m-%d")

        url = "https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='" + activityDate + "T00:00:00'&endDateTime='" + activityDate + "T23:59:59'"
        header = {'Content-Type':'application/json', 'Authorization':f'Bearer {access_token}'}
        api_call = requests.get(url=url, headers=header)
        print(api_call)
        print(api_call.json())

    except KeyError:
        raise Exception(response['error_description'])

except Exception as ex:
    raise Exception('Error retrieving Access token\n' + str(ex))

[Anonymous]

Hi @VSmart,

Perhaps you can take a look at the following link that mentions about the similar issues:

Solved: Using a Service Principal for the Activity Events ... - Microsoft Power BI Community

Regards,

Xiaoxin Sheng

[VSmart]

Thank you error disappear when i remove Tenant.ReadAll and Tenant.ReadWriteAll. It writted in documentation. https://learn.microsoft.com/en-us/rest/api/power-bi/admin/get-activity-events#permissions

[PravinPCUK]

@VSmart 

I have tried this. Removed all the admin-consent required from API permissions. Still getting 401 error for activity events data.

• I have added my Service Principal security group in "Service principals can call Fabric public APIs" & "Service principals can access read-only admin APIs" in PBI Service Admin portal,
• Assigned Fabric Admin role to API security group

But still getting 401 error for activity events. I'm able to get the reports/datasets list though.

Let me know if I'm doing anything wrong.

[Anonymous]

HI @VSmart,

I'm glad to hear you find the root causing and share the resolution here, they will help others who faced the similar issues.
Regards,

Xiaoxin Sheng