Power BI REST API - retrieving activity events returns 403 / "API is not accessible for application"

[micpol]

Hello,

I am trying to get activity logs using a Power BI secrvice principal. Once a valid access token is retrieved, it is possible to use the Power BI REST API for example to get the groups (GET https://api.powerbi.com/v1.0/myorg/groups) - it works fine. 

Hoerver, when I attempt to get activity events (GET https://api.powerbi.com/v1.0/myorg/admin/activityevents) a 403 Forbidden error with the following message is returned:

{

"Message": "API is not accessible for application"
}

The service principal has all requires scopes and also the admin role. The doc says that it is possible to "authenticate via service principal"  (ref. to https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents), so my understaing is that this API can be used with a service principal.

Any idea?

Best regards,

Michal

[Jithendra-Vetup]

Hi @Azure_newbie 

I know it might seem super counterintuitive, but here's what you need to do: remove all API privileges for the service principal. Azure somehow associates the role within the token, and that’s the issue.

To troubleshoot, double-check your token using this tool.

Here’s the step-by-step process to resolve the issue:

1. Remove all privileges for the service principal.
2. Add the service principal to a new security group.
3. Go to the Power Admin portal -> Tenant Settings -> Admin API Settings, and add the newly created security group there.

This should resolve the issue.

Cheers !

[shubh43]

The URL in the Microsoft API documentation is wrong for service principals.

You need to also include the workspace ID in the URL, see below

https://api.powerbi.com/v1.0/myorg/groups/{WorkspaceID}/admin/activityevents)

[micpol]

HI Shubh43,

thanks for your reply.

I gave a try to that URL with a valid workspace ID, unfortunatlly it returned a 404 error.

Where did you get this URL from? Is it anywhere documented?

Best reagards,

Michal

[PowerMS]

Hi, 

I'm facing the same issue with the API https://api.powerbi.com/v1.0/myorg/admin/activityevents

1- I have created an app registration with the API permissions :

Tenant.Read.All

Tenant.ReadWrite.All

3-created Security Group in Azure Active Directory with the role  "Power BI administrator "

4- Added the app to the Security group 

5-Add the security group to the Admin API tenant setting in the Power BI admin portal

and I'm still having the error message "{"Message":"API is not accessible for application"}" 

Any help please ? 

Regards,

[SteveAtCity]

I am seeing the same issue as @micpo and @sjkpdk when trying to use the activityevents API from Azure Data Factory. 

@V-lianl-msft :

Has anyone been able to get this method to work?

If not can what alternatives are there to extract power bi audit log activity?

What does the documentation mean by

• " The user must have administrator rights . . . to call this API or authenticate via service principal."
• "Required scope: Tenant.Read.All or Tenant.ReadWrite.All."

[sjkpdk]

We are also unable to get this to work. It is really fustrating when the docs state that it should work for a service principal, but in reality it doesnt seem to be the case. 

[V-lianl-msft]

Hi @micpol ,

You must meet these requirements to access the Power BI activity log:

• You must either be a global admin or a Power BI service admin.
• You have installed the  Power BI Management cmdlets locally or use the Power BI Management cmdlets in Azure Cloud Shell.

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[micpol]

Hi @V-lianl-msft ,

thank you for your reply.

My case is related to embedding content for customers (https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-sample-for-customers?tabs=net-fra... , https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal ), so I am using a Power BI servcice principal (App account), not an AAD user account.

The service principal has been added to Power BI service admin list as well as required scopes have been set correctly.

Furthermore, I am talking to the Power BI service by means of the REST API (https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents) from within my application (backend), I am not using any Power BI Management cmdlets.

According to https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents it is possible to get authenticated via service principal. Note that other Power BI REST APIs are working fine.

In this particular case the message I am facing is "API is not accessible for application" and the HTTP error code is 403 Forbidden. It seems to me that the https://docs.microsoft.com/en-us/rest/api/power-bi/admin/getactivityevents does not work with a service principal.

Summarizing, is that feasible to get acticity events using a service principal created for the "embed content for your customers" case at all? I would like to have acccess to that activity log from within an application (backend).

Best reagrds,
Michal

[Azure_newbie]

Did you get that resolved? It is 2024 and it is still not easy to set it up.

Microsoft should really clarify their documentation.