Listing Power BI Dashboards from REST API using Service Principal

[iw-morr]

I need to get a list of Power BI dashboards from the REST API using a Service Principal.  I tried using a master account, but we use MFA and I couldn't find a way to authenticate to the API that way.  I've tried following countless online resources, but I just wind up going in circles.

One issue I have is adding a service principal as an admin to my Power BI workspace.  I went to Power BI Admin Portal > Workspaces > Access, but I don't know what the display name of my service principal is and using the registered application's name doesn't return any results in the search box.

Another approach I've taken is to use the "entire organization" option under the Power BI Admin Portal > Tenant Settings > Developer Settings > Allow Service Principals to use Power BI APIs thinking it would bypass security groups, but I receive a "API is not accessible for application" response when hitting https://api.powerbi.com/v1.0/myorg/dashboards and an empty result set when hitting https://api.powerbi.com/v1.0/myorg/groups.

I'm sure I'm missing something that will be obvious in hindsight.  Can someone shed some light where I'm going wrong?

[MattCalderwood]

Hi @iw-morr 

You will need to have the service principal listed in the access list of any workspaces you are trying to access via API.
Enabling 'Entire Organisation' under the developer service principal settings will only change which service principals can be used IF you have applied security groups.

It can take time between enabling service principals and them being available in the workspace access list... but if you still cannot see it -> you need to make sure that you are using the V2 Workspaces, as Service Principals cannot be used with the original style workspaces.

The account should also be searchable via its Name but not its AppID - so you will need to look this up from Azure. (Display Name from the App Registration page)

Another thing to check (assuming you have access to Azure for doing this) -> is to make sure that the service account has been given permissions to access the parts of the API you are trying to use.

API Permissions for the account you are using should look something like this...

Azure Permissions list for Power BI API

Wihtout these set, you will hit authentication issues when using the API, and the error messages you recieve are not always that helpful, so it is always worth double checking this list.

You might have already tried some of these things, but let me know if any of this helps.

Matt

[iw-morr]

I found that I was missing the tenant permissions. I added them, but I get a warning. Is this something that my Azure portal admins need to approve, or is there some sort of authentication process I need to use that will prompt the service principal to accept?  I tried both delegated and application with the same results (I'm not sure what the difference is).

[MattCalderwood]

Yes - you will need to get your Azure administrator to accept/confirm those permissions.
In terms of permission type - I have always used 'Delegated Permissons'. This lets you access the API as the user account or service principal with the permissions defined - and is appropriate for this purpose.

The difference between the two can be confusing to say the least - but is essentially a difference in the way that authentication claims are presented & validated by the service being accessed.  https://docs.microsoft.com/en-us/azure/active-directory/develop/developer-glossary#permissions

"... a public client can't securely maintain credentials, it can only request delegated permissions"

Hope this helps.

[iw-morr]

I was able to get the permissions approved by an Azure administrator.  I'm still not able to query dashboards from the API though.

I changed the developer settings to specific security groups for the service principal and added the security group the service principal is in, then I waited 15 minutes.  I'm still not able to query dashboards from the API though.

I tried once again to add my service principal to my workspace, but the search doesn't turn up any results for the registered application name or the security group name.

I believe I'm using workspaces v2, but how do I check to be sure?  Is there anything else I'm missing?

[Jayendran]

Hi @iw-morr ,

May i know what is the error you are getting ? Please share the error description.

[iw-morr]

No error when I try to add the service principal to the workspace, it just doesn't show up in the search results and it won't let me directly type it.

The error I get when trying to list dashboards from the API with my service principal is:

{

    "Message": "API is not accessible for application"

}

[MattCalderwood]

You can check if you are using V2 workspaces by accessing the context menu from your workspace list.

V1 Workspaces have an option called "Edit this workspace"
V2 Workspaces have options for "Workspace Settings" and "Workspace Access"

The Workspace Access option opens up the acess list and should look like this...


Typing the app name into the email field 'should' bring up the account. It wont lookup the app service principal by its unique ID.

[iw-morr]

@Jayendran,

I need to be able to get a list of all dashboards and reports within a workspace from the API while unattended.  I can't use a master account because we have MFA enabled so I could never get it to fully authenticate without user intervention.  Is there not a way to do this using a service principal, or a way to bypass MFA for master accounts?

@MattCalderwood,

I have this (see screenshot below) for the context menu.  Does this mean V1 or V2?  Also, the registered application name definitely does not appear in the search.  When I type it out and hit enter, I get this error: "These email addresses are invalid or duplicate: <Registered App Name>".

[MattCalderwood]

That looks like V2 workspaces to me.
The older workspaces dont give you the option to manage the access list from the workspace list in the admin portal (as shown in your screenshot).

Service principal accounts are the preferred way of accessng the API's (given you aren't caught out by one of the known limitations), Accessing a list of dashboards and reports is well within these limitations.

[iw-morr]

If I can't use the My Workspace queries (assuming that translates to the https://api.powerbi.com/v1.0/myorg/ path in the API) with a service principal, and I can't use the admin APIs with a service principal, which API endpoint would give me a list of dashboards?

Also, what would prevent my registered application name from appearing in the search results from the workspace access form?

[MattCalderwood]

I'm not 100% sure what would be blocking the service principal from appearing in the access list.

In terms of the API endpoint to use, I have used the 'Get Dashboards In Group' endpoint with a service principal account in the past, and this has worked fine. https://docs.microsoft.com/en-us/rest/api/power-bi/dashboards/getdashboardsingroup

Make sure you check the required scopes listed against each endpoint, and ensure that they have been added to your service principal API permissions.

The endpoint above shows -> Required scope: Dashboard.ReadWrite.All or Dashboard.Read.All 

I will try and find some time to try and replicate the access list issue later.

[iw-morr]

I appreciate your help on this so far.  I think I'm still running up against the workspace access issue for the service principal though.

Your advice to use the dashboards in group endpoint led me to try the groups endpoint (https://api.powerbi.com/v1.0/myorg/groups) again to get a group ID.  It's still resulting in the following response:

{
  "@odata.context": "http://api.powerbi.com/v1.0/myorg/$metadata#groups",
  "@odata.count": 0,
  "value": []
}

[iw-morr · Accepted solution]

For posterity, I figured this out with the help of a Microsoft Support ticket.

There are 2 identical workspace access forms.  One you get to from the left navigation > Workspaces > 3 dots next to the workspace > Workspace access.  The other from Admin Portal > Workspaces > 3 dots next to the workspace > Access.  The first one works as expected.  The second one does not search for service principals/registered apps.

[MattCalderwood]

Nice one! Glad you managed to solve the issue.

I had gone back to look at some code that was working perfectly with Service Principals and couldn't replicate what you were seeing against the API, and the non-visible SP search thing was a complete mystery.

Are you still having issues with the API now that the SP is listed correctly?

[iw-morr]

API is working as expected now.  Thanks again for all of your help!

[Jayendran]

Hi @iw-morr ,

Could you please explain how you solved your problem ? so that it will help others too. If any of the community members replies helpful to you please give kudos.

[Jayendran]

Hi @iw-morr ,

This is because you are trying to call Dashboards in My Workspace using the SPN autentication. Currently this is the known limiation for SPN

https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal#considerations-...

You have to use Master account approach in this kind of situation.