Get admin access to personal workspace through REST API

[Yondice]

Hello,

I have Power BI Admin rights for my organization and I'm trying to automate a task that requires me to get access to users personal worksapces. I know I'm able to go into the Admin Portal -> Workspaces -> click on the options button for a personal workspace and click the "Get Access" button, but is there any way to do this through API calls? Or can it only done through the GUI?

I've tried these API endpoints with no success:

• Admin - Groups AddUserAsAdmin
  • This endpoint can't be called using a service principal, so I called it with my account which has administrator rights. It returned a 400 Bad Request status with code "PowerBIOperationNotSupported".
• Groups - Add Group User
  • Tried calling it with my admin account, returned 401 Unauthorized.
  • Tried calling it with service principal, returned 404 Not Found status with code "PowerBIEntityNotFound"

Based on these results I'm guessing it can't be done through API, but would like to hear if anyone else has tried this and had any luck.

Couldn't find any recent posts on the topic, the one similar post I found here seems to be from before admins could even give themselves access through the GUI.

Thanks,

Yondice

[Yondice · Accepted solution]

Update:

I took the advice of a couple commenters and tried going down the PowerShell route with the "Add-PowerBIWorkspaceUser" command, but had no success. I tried both options for the -Scope parameter, along with several combinations of the other parameters and nothing worked.

I also looked up other forum posts specifically about performing this task through PowerShell instead of the API, and it was a mixed bag of answers on whether or not it's possible. I couldn't find anyone saying they got it to work, only one or two people saying it should work if the OP changes this, that, and the other thing.

However, I did find a way to do it via API call... just not with any of Microsoft's documented REST API endpoints.

I found the API endpoint by running Fiddler to trace my system traffic then clicking on the "Get Access" button for a personal workspace in the Power BI admin settings GUI. The below API call was being used to perform the action of adding an admin to the personal workspace. I was able to recreate and successfullY call this API in Postman and in a C# desktop app by adding the headers shown.

Method: PUT

Url: 

https://wabi-west-us-d-primary-redirect.analysis.windows.net/metadata/admin/workspaces/~WorkspaceId~/adminAccess

Headers (Key : Value):

• Authorization : Bearer ~XXXXXX~
• Referer : https://app.powerbi.com
• Origin : https://app.powerbi.com
• X-PowerBI-HostEnv : Power BI Web App
• X-PowerBI-User-Admin : True

To generate a bearer token that works with this API call, I used PowerShell. Start with the "Connect-PowerBIServiceAccount" command and log in with an account that has Power BI administrator rights. Then use the "Get-PowerBIAccessToken -AsString" command to generate the bearer token and show it as an output in the PowerShell terminal.

I'm guessing there's no guarantee this method will work indefinitely since it's not one of their supported REST API endpoints, but it's getting the job done for now.

One last note, doing it this way should be the same as doing it through the GUI where it will automatically revoke your access after 24 hours. But in case you want the equivalent of clicking the "Remove access" button in the GUI, you can just change the API call from a PUT to a DELETE. The URL and all the headers can stay the same. This was also found through a Fiddler trace, and tested in Postman and my C# app.

[lbendlin]

yes, something like

Get-PowerBIWorkspace -Scope Organization -Filter "tolower(name) eq 'my workspace'" -Type PersonalGroup

And then you can add yourself based on the workspace ID.

[lszymk97]

Not sure if that's helpful, but maybe you can find a way around using PowerShell:

 https://powerbi.microsoft.com/en-us/blog/working-with-powershell-in-power-bi/

[mariussve1]

Following because I have the same usecase