Power BI API GetActivity Metrics Issue with Power BI Service Principal

[Alanator500]

Hello Fabric Community,

I'm hoping someone would be able to point me in the right direction. I am attempting to call and populate reporting on the Power BI Service using the Power BI API Documentation. I have moved to a new tenant and followed everything I did in my old tenant. Service Principal is created and inside a group, that group is in workspaces as admin permission, I have set the settings in the admin portal for "Service Principals can call Fabric public APIs" and "Service Principles Can access Read-Only Admin APIs".

I have granted the App Registration all these permissions

Unfortunately when I try an admin call for get activites to assemble usage in Postman I am getting the following:

{

    "error": {

        "code": "PowerBINotAuthorizedException",

        "pbi.error": {

            "code": "PowerBINotAuthorizedException",

            "parameters": {},

            "details": [],

            "exceptionCulprit": 1

        }

    }

}

Everything I have read is having me go through everything I believe I have set correctly. The service Principal can access APIs that are not admin, but these do not get to the activity level. I'm not sure with this application having access to to all these permissions, especially at the Tenant Read and Tenant Read/Write level, it still cannot access the admin apis.

Any help would be much appreciated.

[Alanator500 · Accepted solution]

I wanted to make sure that I rounded this out. Looking further into the documentation around the Admin APIs. There are a couple things that needed to happen to grant my SP access.

1. The documentation states that "When running under service prinicipal authentication, an app must not have any admin-consent required premissions for Power BI set on it in the Azure portal." (Admin - Get Activity Events - REST API (Power BI Power BI REST APIs) | Microsoft Learn) This meant I needed to revoke any admin-consent required permissions Tenant.Read.All and Tenant.ReadWrite.All

2. I needed to have the SP granted the role of Fabric Admin. (Not sure if this was necessary)
3. I had already done this but for a rounded out solution you need to make sure that Power BI Admin portal had "Service Principals can use Fabric APIs" and "Service Principals can use read only Admin APIs" flipped to "enabled" with the security group your SP is in the only group granted access.

The points in number 1 & 2 were new to me, a couple years ago I was able to set it up with the admin consent permissions, this however must have changed. Once I followed the three above, the SP could access no problem. 

[Alanator500]

Hello,

Thank you for this additional information. I thought that the snapshot of the Power BI Admin Portal was clear on this. My Service Principal is apart of a security group. I "Enabled for a subset of the organization" and placed that security group as the only group allowed to use APIs for Power BI. I have also made sure not to check the box that says "Except" because I am aware that would mean everyone else except the security group, which is not the outcome I want. I am requesting the token with app ID and Secret using the scope "https://analysis.windows.net/powerbi/api/.default". Just wanted to clarify what has been done.

Now I did notice that last sentence, "and if needed, confirm the account has the Power BI Service Admin or Global Admin role." Are you indicating that we can give the Service Principal the Power BI Service Admin role? Just to test I used the Learn site to call the events using my Power BI Admin credentials, that did work but this would not be useful for auto refresh in the Service.

However if the service principal is able to be granted Power BI Admin Role then that may solve the block I am running into. I thought granting the Tenant.Read.All access offers this.

Again thanks for your help on this, sorry for so many additional questions.

[v-kpoloju-msft]

Hi @Alanator500, 
Thank you for sharing the details and screenshots.

The error PowerBINotAuthorizedException indicates that your Service Principal does not yet have the required tenant-level permissions to call the Get Activity Events Admin API. While you have already granted API permissions and enabled “Service principals can call Fabric public APIs” and “Service principals can access read-only admin APIs”, there is one extra step. 

The Service Principal must be added to a security group that is explicitly allowed in the Power BI Admin portal under Tenant settings → Admin API settings. Simply having workspace admin rights or API consents in Entra ID is not enough for this admin API. Please also make sure you are requesting the token with the scope https://analysis.windows.net/powerbi/api/.default, and if needed, confirm the account has the Power BI Service Admin or Global Admin role. 

Refer these links:
1. https://learn.microsoft.com/en-in/fabric/enterprise/powerbi/service-premium-service-principal#allow-... 
2. https://learn.microsoft.com/en-in/rest/api/power-bi/admin/get-activity-events 

Hope this helps you move forward. Please give it a try and let us know how it goes.
Thanks for using the Microsoft Fabric Community Forum.