Guidance on Updating Cloud Connection Data Source Credentials Using Rest API

[rmjenkinsquest]

The scenario I am trying to solve for is programmatically updating semantic model cloud connection data source credentials for service principal authentication via REST API. The background is that we are attempting to deploy resources from a Git repository to the PowerBI service via PowerShell script and this requires transferring ownership to the service principal used in that automation, which clears any pre-configured data source credentials per Fabric security

I am trying to follow the Datasets - Update Datasources In Group documentation but not finding much helpful information or examples on how to write the payload with the authentication method (service principal), tenant ID, service principal ID, service principal key, and the privacy-level setting. Can someone (a) confirm this is supported for and (b) guide me on how to accomplish it? 

[Anonymous]

Hi  @rmjenkinsquest ,

According to our understanding, the fields you provided in the screenshot such as tenant ID, SP ID/secret are required fields to generate the AAD token in order to use the generated AAD token as authorization to run the Power BI rest API, so these fields are not provided as parameters in the Power BI rest API. So these fields are not provided as parameters in the Power BI rest API, but are required fields to get the AAD token in the previous step.

Datasets - Update Datasources In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

And the Power Automate HTTP action solution I provided before is combining the AAD token acquisition step directly inside the action, so these fields need to be filled in during this validation step:

There are also options on how to use the API directly to get AAD tokens, you can search for similar Q&A documents online:

Generate Access Token via Service Principal - Microsoft Q&A

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[rmjenkinsquest]

Hi Liu,

Apologies for the confusion that may have resulted from an incomplete screenshot--I cropped the prompt so as to conceal the server and database information. The screenshot is for configuring data source credentials on a semantic model ("Settings" of the semantic model → "Data source credentails" → "Edit credentials), not in generating an access token for the REST API

Here are the tasks we are attempting via PowerShell:

1. Build service principal credential and generate access token for subsequent calls (Working)

2. Connect to workspace environment (Working)

3. Import semantic model from Git repository and bind to report (Working)

4. Update semantic model parameters in group (Working)

5. Configure semantic model data source credentails

The fifth task is what I have been unable to accomplish thus far and am looking for guidance on, since I have not found any helpful examples on using Datasets - Update Datasources in Group for service principal-type authentication to the database for the semantic model

[Anonymous]

Hi  @rmjenkinsquest ,

You may consider using the "HTTP" action in the Power platform product Power Automate because it can softly support the Azure AD authorization using service principal, you can simply grant the enough permission to the service principal's binded Azure application and generate the client secret with the client ID to try to send the same API structure with service principal authorization to make a test

You can also first test the rest API in the third-party API test tool postman:

Postman API Platform | Sign Up for Free

Regarding the HTTP action using guide detail:

www.m365princess.com

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[rmjenkinsquest]

Really appreciate the suggestion, however we are attempting to automate this through a PowerShell script that can be referenced inside an Azure Pipelines task for a CI / CD workflow. I also want to clarify that the issue is with populating these data source credential fields on the semantic model via a REST API: 

The authentication used to make the calls are working fine; it's that I am finding limited information on how to structure an API call to post the same details as I would enter from the frontend, as in the screenshot above. Let me know if I can clarify anything further