Invalid identifier error when removing dataset user

[psaliba]

Using this API call I can and have removed dataset users:

https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/put-dataset-user-in-group

With this payload:

{'identifier': <user id>, 'principalType': 'User', 'datasetUserAccessRight': 'None'}

My problem is that this fails when the user being removed is not in AAD anymore (they left the company.) The user being removed does not have write permissions or inherited permissions.

The user id in my case is an email address that is pulled from the identifier field in the response from a call to:

https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/get-dataset-users-in-group

Again the same call/payload construction work if it is an existing AAD user, but I need to clean out permissions for users that have left.

Also it is a User, not a group or an app that i'm having the issue with.

The response is a 400, Bad Request. Error message returned is:

{"error":{"code":"InvalidRequest","message":"Parameter identifier is missing or invalid"}}

Any pointers on how remove these users would be appreciated. Thanks!

[Anonymous · Accepted solution]

Hi @psaliba,

I think this scenario should meet the limitations listed on the API document, perhaps you can take a look on it at the first:

Datasets - Put Dataset User In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

In addition, the user account turns on/off should be a pain part for the permission manager, they obviously will change some global settings and properties that affect the common feature and corresponding API usages which are hard to trace and fix.

For the above scenario, you can try to create a user group on the Azure side for API usage instead of accurate add/removing each user, it will be simpler to manage the group members.

Regards,

Xiaoxin Sheng