Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Enhance your career with this limited time 50% discount on Fabric and Power BI exams. Ends August 31st. Request your voucher.

Reply
Anonymous
Not applicable

[HELP!] Powershell Automation Script to add group to PowerBI Workspaces with a service principal

Hi !

I am trying to automate a PowerBI task using a service principal.

With a powershell script i want to add a group to all the workspaces in my organization. 

I am using :

Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -Tenant $tenant 

To connect with my service principal which works.
And then i want to retrieve all my workspaces by using :

 

Get-PowerBIWorkspace -All -Scope Organization -Type Workspace -Include All

But it doesn't work....

Error :

Failed to connect or retrieve workspaces: Operation returned an invalid status code 'Unauthorized'

It works if i don't put the -Scope Organization but in my case i want ALL the workspaces...

I made sure that the group and service principal got all the permissions in powerbi tenant or api settings as well. 
They are literally Admin of the organization...

So if anyone know how to do it or want to help, feel free to talk !

Thanks.



4 REPLIES 4
Anonymous
Not applicable

Hi  @Anonymous ,

 

If it is convenient, can you check the following two points again?

1. Tenant Setting: Make sure that the option “Allow service principals to use Power BI Admin APIs” is enabled for your tenant.

Use Power BI API with service principal (Preview) | Microsoft Power BI Blog | Microsoft Power BI

2. Application API Permissions: You should not add any application permissions; only delegated permissions should be added. 

Quickstart: Configure an app to access a web API - Microsoft identity platform | Microsoft Learn

 

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Anonymous
Not applicable

Hi @Anonymous , 

Yes no problem.
So 1 - Tenant settings :

Quentinmlx_0-1717062404479.pngQuentinmlx_1-1717062419750.png

The service principal is in the security group called "THELIO-PBI-ADMINISTRATORS-SERVICES" and it is also this group that i want to automatically add to every workspaces using the service principal.

And point 2 : yes i only have delegated api permissions for my ServicePrincipal there they are :

Quentinmlx_2-1717062663797.png

 

Quentinmlx_3-1717062704537.pngQuentinmlx_4-1717062719750.pngQuentinmlx_5-1717062733462.png

(i know there are more than needed but at first it was to be sure he could access everything)


Best Regards,
Quentin Michelix.

Anonymous
Not applicable

Hi @Anonymous .

Thanks a lot for your reply.
So with the first topic you sent it would more in my case but the -Scope Organization is to make sure to retrieve ALL the workspaces available. It works with a user account but not with the service principal.

The goal is to be able to retrieve all the workspaces so that with the service principal i can add a group as admin to all workspaces. So the second topic you sent wasn't relevant for this case. Thanks.

Here's the code for the acces and token :

# Authenticate with Service Principal to Power BI API
try {
    $secureSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
    $credential = New-Object System.Management.Automation.PSCredential($clientId, $secureSecret)
    Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -TenantId $tenant
    Write-Host "Connected to Power BI Service Account successfully" -ForegroundColor Green
} catch {
    Write-Host "Failed to connect to Power BI Service Account: $_" -ForegroundColor Red
    exit
}

# Obtain access token using client credentials flow for Power BI API
$body = @{
    grant_type    = "client_credentials"
    client_id     = $clientId
    client_secret = $clientSecret
    scope         = "https://analysis.windows.net/powerbi/api/.default"
}

try {
    $tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenant/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body
    $accessToken = $tokenResponse.access_token
    Write-Host "Obtained access token successfully" -ForegroundColor Green
} catch {
    Write-Host "Failed to obtain access token: $_" -ForegroundColor Red
    exit
}

$headers = @{
    Authorization = "Bearer $accessToken"
}

and then i try to retrieve workspaces :

# Retrieve all workspaces using Admin API
try {
    $url = "https://api.powerbi.com/v1.0/myorg/admin/groups?\$top=5000"
    $workspacesResponse = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
    $workspaces = $workspacesResponse.value
    Write-Host "Retrieved workspaces successfully" -ForegroundColor Green
    $workspaces | Format-Table Id, Name
} catch {
    Write-Host "Failed to connect or retrieve workspaces: $_" -ForegroundColor Red
    Write-Host "Detail: $_.Exception.Message" -ForegroundColor Red
    Disconnect-PowerBIServiceAccount
    exit
}

Write-Host "=================================================================================================================================="
Write-Host "Found a total of $($workspaces.Count) workspaces..."
Write-Host "=================================================================================================================================="

But this will not work because i use admin/groups .. If  i don't use admin it works but will return me the workspaces where the group is already in (not what i want)...

Thanks,
Best Regards,
Quentin Michelix.

Anonymous
Not applicable

Hi  @Anonymous ,

 

Can you provide us with the exact parameters that are put in the request body to ensure that the token is not obtained by password, but by service principal.

You can try to check again if the client permissions of the service principal are sufficient.

As far as I know:

-Scope

Indicates scope of the call. Individual returns only workspaces assigned to the caller; Organization returns all workspaces within a tenant (must be an administrator to initiate). Individual is the default.

Expand table

Required Scope

Tenant.Read.All or Tenant.ReadWrite.All

Relevant only when authenticating via a standard delegated admin access token. Must not be present when authentication via a service principal is used.

 

This is the related document, you can view this content:

Solved: Service Principle cannot Get-PowerBIWorkspace - Microsoft Fabric Community

Solved: Error Get-PowerBIDataSet - Unauthorizated - Microsoft Fabric Community

 

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Helpful resources

Announcements
July 2025 community update carousel

Fabric Community Update - July 2025

Find out what's new and trending in the Fabric community.

July PBI25 Carousel

Power BI Monthly Update - July 2025

Check out the July 2025 Power BI update to learn about new features.