Issue with Power BI API Permissions for Datasets - 401 Unauthorized "PowerBINotAuthorizedException"

[Xiaolingwh]

I am encountering an issue accessing the endpoints for reports and datasets in the Power BI API. 

I generate the access token with:

             “auth_url” :   https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token

              grant_type": client_credentials,

              "client_id": CLIENT_ID,

             "client_secret": CLIENT_SECRET,

             "scope": "https://analysis.windows.net/powerbi/api/.default"

Test in postman.

1. GET https://api.powerbi.com/v1.0/myorg/groups/{WORKSPACE_ID}/datasets - Successfully
2. POST  https://api.powerbi.com/v1.0/myorg/groups/{WORKSPACE_ID}/datasets/{DataSet_ID}/executeQueries - Got error.  401 Unauthorized "PowerBINotAuthorizedException"

I had enabled Service Principal Access in Power BI and granted all the necessary permissions:    

1. Enabled "Service principals can use Fabric APIs," in admin portal
2. Added the Service Principal as Admin in the Power BI Workspace
3. Added all datasets and reports permissions under ‘delegated permissions’ because they do not exist under ‘application permissions’.

It seems that the datasets and reports permission should be added with API permission type, but the application permissions only show ‘Tenant.Read.All’ and ‘Tenant.ReadWrite.All’ ?  Anything I miss?

[v-echaithra]

Hi @Xiaolingwh ,

Thank you for reaching out to Microsoft Community.

Since the GET datasets API is working, the authentication setup appears to be correct. The 401 Unauthorized "PowerBINotAuthorizedException" during ExecuteQueries is usually related to dataset permissions or tenant settings.

Please verify the following:

Ensure both tenant settings are enabled in Power BI Admin Portal:
Service principals can use Fabric APIs
Dataset Execute Queries REST API

Explicitly grant the Service Principal:
Build permission, read permission on the dataset under Manage Permissions.

Verify the semantic model is not using unsupported scenarios such as RLS, SSO, or certain Live Connections.

Confirm the access token audience (aud) is: https://analysis.windows.net/powerbi/api

If tenant settings are restricted to a security group, ensure the Service Principal is added to that group and allow time for propagation.

Also, it is expected that Dataset/Report permissions are available only as Delegated permissions in Azure AD. Most Power BI REST APIs with Service Principals rely on workspace and tenant-level authorization rather than Application API permissions.

Hope this helps.