Power BI is turning 10! Tune in for a special live episode on July 24 with behind-the-scenes stories, product evolution highlights, and a sneak peek at what’s in store for the future.
Save the dateEnhance your career with this limited time 50% discount on Fabric and Power BI exams. Ends August 31st. Request your voucher.
Hi !
I am trying to automate a PowerBI task using a service principal.
With a powershell script i want to add a group to all the workspaces in my organization.
I am using :
Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -Tenant $tenant
To connect with my service principal which works.
And then i want to retrieve all my workspaces by using :
Get-PowerBIWorkspace -All -Scope Organization -Type Workspace -Include All
But it doesn't work....
Error :
Failed to connect or retrieve workspaces: Operation returned an invalid status code 'Unauthorized'
It works if i don't put the -Scope Organization but in my case i want ALL the workspaces...
I made sure that the group and service principal got all the permissions in powerbi tenant or api settings as well.
They are literally Admin of the organization...
So if anyone know how to do it or want to help, feel free to talk !
Thanks.
Hi @Anonymous ,
If it is convenient, can you check the following two points again?
1. Tenant Setting: Make sure that the option “Allow service principals to use Power BI Admin APIs” is enabled for your tenant.
Use Power BI API with service principal (Preview) | Microsoft Power BI Blog | Microsoft Power BI
2. Application API Permissions: You should not add any application permissions; only delegated permissions should be added.
Quickstart: Configure an app to access a web API - Microsoft identity platform | Microsoft Learn
Best Regards,
Liu Yang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Hi @Anonymous ,
Yes no problem.
So 1 - Tenant settings :
The service principal is in the security group called "THELIO-PBI-ADMINISTRATORS-SERVICES" and it is also this group that i want to automatically add to every workspaces using the service principal.
And point 2 : yes i only have delegated api permissions for my ServicePrincipal there they are :
(i know there are more than needed but at first it was to be sure he could access everything)
Best Regards,
Quentin Michelix.
Hi @Anonymous .
Thanks a lot for your reply.
So with the first topic you sent it would more in my case but the -Scope Organization is to make sure to retrieve ALL the workspaces available. It works with a user account but not with the service principal.
The goal is to be able to retrieve all the workspaces so that with the service principal i can add a group as admin to all workspaces. So the second topic you sent wasn't relevant for this case. Thanks.
Here's the code for the acces and token :
# Authenticate with Service Principal to Power BI API
try {
$secureSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $secureSecret)
Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -TenantId $tenant
Write-Host "Connected to Power BI Service Account successfully" -ForegroundColor Green
} catch {
Write-Host "Failed to connect to Power BI Service Account: $_" -ForegroundColor Red
exit
}
# Obtain access token using client credentials flow for Power BI API
$body = @{
grant_type = "client_credentials"
client_id = $clientId
client_secret = $clientSecret
scope = "https://analysis.windows.net/powerbi/api/.default"
}
try {
$tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenant/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body
$accessToken = $tokenResponse.access_token
Write-Host "Obtained access token successfully" -ForegroundColor Green
} catch {
Write-Host "Failed to obtain access token: $_" -ForegroundColor Red
exit
}
$headers = @{
Authorization = "Bearer $accessToken"
}
and then i try to retrieve workspaces :
# Retrieve all workspaces using Admin API
try {
$url = "https://api.powerbi.com/v1.0/myorg/admin/groups?\$top=5000"
$workspacesResponse = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
$workspaces = $workspacesResponse.value
Write-Host "Retrieved workspaces successfully" -ForegroundColor Green
$workspaces | Format-Table Id, Name
} catch {
Write-Host "Failed to connect or retrieve workspaces: $_" -ForegroundColor Red
Write-Host "Detail: $_.Exception.Message" -ForegroundColor Red
Disconnect-PowerBIServiceAccount
exit
}
Write-Host "=================================================================================================================================="
Write-Host "Found a total of $($workspaces.Count) workspaces..."
Write-Host "=================================================================================================================================="
But this will not work because i use admin/groups .. If i don't use admin it works but will return me the workspaces where the group is already in (not what i want)...
Thanks,
Best Regards,
Quentin Michelix.
Hi @Anonymous ,
Can you provide us with the exact parameters that are put in the request body to ensure that the token is not obtained by password, but by service principal.
You can try to check again if the client permissions of the service principal are sufficient.
As far as I know:
-Scope
Indicates scope of the call. Individual returns only workspaces assigned to the caller; Organization returns all workspaces within a tenant (must be an administrator to initiate). Individual is the default.
Expand table
Required Scope
Tenant.Read.All or Tenant.ReadWrite.All
Relevant only when authenticating via a standard delegated admin access token. Must not be present when authentication via a service principal is used.
This is the related document, you can view this content:
Solved: Service Principle cannot Get-PowerBIWorkspace - Microsoft Fabric Community
Solved: Error Get-PowerBIDataSet - Unauthorizated - Microsoft Fabric Community
Best Regards,
Liu Yang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
User | Count |
---|---|
5 | |
4 | |
3 | |
2 | |
2 |
User | Count |
---|---|
8 | |
7 | |
4 | |
4 | |
4 |