Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
7 years ago
Solved

Power Bi REST API - 401 Authorization error when using Service Principals

Hi!   I've been following this guide while setting up my app. Everything works fine if I use password credentials flow and supply my own userame/password to get an access token. However, if I try t...
Need Help
  • v-jiascu-msft's avatar
    v-jiascu-msft
    7 years ago

    Hi Anonymous ,

     

    I made the Service Principal work in the "App Owns Data" demo and with the Rest APIs. It seems everything is set up correctly according to your description. Some suggestions are as follows.

    1. Add the Service Principal as an admin in the workspace directly rather than add the security group. Please refer to article 5 in embed-service-principal#get-started-with-a-service-principal. We should use the Object ID.

    Power-Bi-REST-API-401-Authorization-error-when-using-Service-Principals

    2. The Service Principal inherit permission from the tenant rather than the Azure App permissions. 

    >>>Service principals inherit the permissions for all Power BI tenant settings from their security group. To restrict permissions create a dedicated security group for service principals and add it to the 'Except specific security groups' list for the relevant, enabled Power BI settings.

    3. I'm afraid you can't call the Admin REST API if the Service Principal doesn't have the permission.

     

    Best Regards,

alexgor87's avatar
alexgor87
Advocate II
2 years ago

Hi all, this resolved the issue for me:

1. Enable the tenant setting "Allow service principals to use Power BI APIs".
2. Create an AAD user group.
3. Create a Service Principal account and add it to the AAD user group.

4. Assign the AAD user group to the workspace access.
5. IMPORTANT! Assign Service Principal account to workspace access directly! So that you would have both AAD user group and Service Principal in the wotkspace access.

6. After that you can remove the Service Principal direct assignment, but the access will still work through AAD user group.

 

Maybe it's a bug, but something is deinitely happening in the background with service principals and AAD user groups access.