Power BI Embedded | Automate configuring Azure Log Analytics for Power BI

[bsmucker]

Hello all,

Following up on a related post for Power BI Premium workspaces, I am attempting to script a process using service principal authentication to add hundreds of workspaces on Power BI embedded SKUs to Log Analytics workspaces.

Similar to the user's post in the related thread, the goal is to connect the workspaces to Log Analytics and automate the process described here: Configure Azure Log Analytics for Power BI

So far, I cannot figure out how to script this process using a service principal and API commands. The closest lead I've found has been the Admin - Groups UpdateGroupAsAdmin API,  but I receive a 401 Unauthorized response when using a service principal that is both a Fabric Administrator and has Tenant.ReadWrite.All permissions as well as Contribtor permissions on the subscription.

The request body for this API call appears to have all of the information we would need to configure the Power BI workspace to use Log Analytics:

{
  "logAnalyticsWorkspace": {
    "subscriptionId": "d778934f-bda2-41d9-b5c7-6cf41372c1a0",
    "resourceGroup": "myResourceGroup",
    "resourceName": "myLogAnalyticsWorkspace"
  }
}

If I run the following command that is similar to the one cited in the linked post, I receive a list of Log Analytics workspaces on my subscription, but not a list of resource IDs for the Power BI workspaces for which I want to configure Log Analytics:

az resource list --resource-type "Microsoft.OperationalInsights/workspaces"

Additionally, not only do we want to connect all workspaces that currently existin our embedded capacity / resource group / subscription, but also we wish to automatically add new ones that are created and added to capacities automatically during onboarding.

Has anyone else had success automating configuring Azure Log Analytics for Power BI at scale?

[lbendlin]

 I am attempting to script a process using service principal authentication to add hundreds of workspaces on Power BI embedded SKUs to Log Analytics workspaces.

I hope you are aware of the cost implications?

[bsmucker]

Yes, but it is a project requirement.

[lbendlin]

Examine the token at jwt.io - you will likely find that the scope is missing. Start over with a fresh app registration, thistime don't use delegated permissions.