Forum Discussion
Power BI API GetActivity Metrics Issue with Power BI Service Principal
I wanted to make sure that I rounded this out. Looking further into the documentation around the Admin APIs. There are a couple things that needed to happen to grant my SP access.
1. The documentation states that "When running under service prinicipal authentication, an app must not have any admin-consent required premissions for Power BI set on it in the Azure portal." (Admin - Get Activity Events - REST API (Power BI Power BI REST APIs) | Microsoft Learn) This meant I needed to revoke any admin-consent required permissions Tenant.Read.All and Tenant.ReadWrite.All
2. I needed to have the SP granted the role of Fabric Admin. (Not sure if this was necessary)
3. I had already done this but for a rounded out solution you need to make sure that Power BI Admin portal had "Service Principals can use Fabric APIs" and "Service Principals can use read only Admin APIs" flipped to "enabled" with the security group your SP is in the only group granted access.
The points in number 1 & 2 were new to me, a couple years ago I was able to set it up with the admin consent permissions, this however must have changed. Once I followed the three above, the SP could access no problem.
Hello,
Thank you for this additional information. I thought that the snapshot of the Power BI Admin Portal was clear on this. My Service Principal is apart of a security group. I "Enabled for a subset of the organization" and placed that security group as the only group allowed to use APIs for Power BI. I have also made sure not to check the box that says "Except" because I am aware that would mean everyone else except the security group, which is not the outcome I want. I am requesting the token with app ID and Secret using the scope "https://analysis.windows.net/powerbi/api/.default". Just wanted to clarify what has been done.
Now I did notice that last sentence, "and if needed, confirm the account has the Power BI Service Admin or Global Admin role." Are you indicating that we can give the Service Principal the Power BI Service Admin role? Just to test I used the Learn site to call the events using my Power BI Admin credentials, that did work but this would not be useful for auto refresh in the Service.
However if the service principal is able to be granted Power BI Admin Role then that may solve the block I am running into. I thought granting the Tenant.Read.All access offers this.
Again thanks for your help on this, sorry for so many additional questions.