Forum Discussion

Alanator500's avatar
Alanator500
Frequent Visitor
10 months ago
Solved

Power BI API GetActivity Metrics Issue with Power BI Service Principal

Hello Fabric Community, I'm hoping someone would be able to point me in the right direction. I am attempting to call and populate reporting on the Power BI Service using the Power BI API Documenta...
Need Help
Tips and Tricks
  • Alanator500's avatar
    Alanator500
    10 months ago

    I wanted to make sure that I rounded this out. Looking further into the documentation around the Admin APIs. There are a couple things that needed to happen to grant my SP access.

    1. The documentation states that "When running under service prinicipal authentication, an app must not have any admin-consent required premissions for Power BI set on it in the Azure portal." (Admin - Get Activity Events - REST API (Power BI Power BI REST APIs) | Microsoft Learn) This meant I needed to revoke any admin-consent required permissions Tenant.Read.All and Tenant.ReadWrite.All

    2. I needed to have the SP granted the role of Fabric Admin. (Not sure if this was necessary)
    3. I had already done this but for a rounded out solution you need to make sure that Power BI Admin portal had "Service Principals can use Fabric APIs" and "Service Principals can use read only Admin APIs" flipped to "enabled" with the security group your SP is in the only group granted access.

    The points in number 1 & 2 were new to me, a couple years ago I was able to set it up with the admin consent permissions, this however must have changed. Once I followed the three above, the SP could access no problem. 

v-kpoloju-msft's avatar
v-kpoloju-msft
Community Support
10 months ago

Hi Alanator500, 
Thank you for sharing the details and screenshots.

The error PowerBINotAuthorizedException indicates that your Service Principal does not yet have the required tenant-level permissions to call the Get Activity Events Admin API. While you have already granted API permissions and enabled “Service principals can call Fabric public APIs” and “Service principals can access read-only admin APIs”, there is one extra step. 

The Service Principal must be added to a security group that is explicitly allowed in the Power BI Admin portal under Tenant settings → Admin API settings. Simply having workspace admin rights or API consents in Entra ID is not enough for this admin API. Please also make sure you are requesting the token with the scope https://analysis.windows.net/powerbi/api/.default, and if needed, confirm the account has the Power BI Service Admin or Global Admin role. 

Refer these links:
1. https://learn.microsoft.com/en-in/fabric/enterprise/powerbi/service-premium-service-principal#allow-service-principals-to-use-admin-apis 
2. https://learn.microsoft.com/en-in/rest/api/power-bi/admin/get-activity-events 

Hope this helps you move forward. Please give it a try and let us know how it goes.
Thanks for using the Microsoft Fabric Community Forum.