I have a console app that uses the REST API to get a dataset (and later add rows to it). This works when I supply my own user/password credentials. Now I have registered the app as a Web/API app in order to use an app key/secret instead. I can get a token, but when I make the same REST call I get 401 Unauthorized. I have given the app the following Application permissions in Power BI Service (is this needed?):Read and write all content in tenantView all content in tenantThese permissions have been granted by an Azure Administrator. In addition to the Delegated permissions that worked with user authentication:Read and write all DatasetsView all Datasets I have decode the two tokens.The token for app key autentication contains this:"roles": ["Tenant.ReadWrite.All","Tenant.Read.All"], while the token for user based authentication contains this:"scp": "Dataset.ReadWrite.All Workspace.ReadWrite.All", What am I missing..?

Hi tripleacoder, As far as I know, the permissions of Power BI are all based on the users. So an App can't act as a user. Please refer to developer/power-bi-permissions where all the descriptions have "user". Regarding "Tenant.ReadWrite.All", the documentation above also has a description. Actually, these permissions only can retrieve the profiles rather than data. Please refer to admin/reports_getreportsasadmin. One simple proof we can see is that even an admin can't access all the App workspaces. The data is the precious asset of a company. I think this is reasonable. Best Regards,Dale

Power Bi REST API - 401 Authorization error when using app secret

23 Replies

Anonymous
Not applicable
6 years ago
Why does the sample code for the power bi embedded 'app owns data' scenario use the client credentials route when it is not supported?
zoloturu
Memorable Member
7 years ago
tripleacoder,

Could you try to mention an access level in API request?

https://docs.microsoft.com/en-us/rest/api/power-bi/embedtoken/reports_generatetoken#tokenaccesslevel

Regards,
Ruslan
-------------------------------------------------------------------
Did I answer your question? Mark my post as a solution!
- tripleacoder
  Helper I
  7 years ago
  
  Could you try to mention an access level in API request?
  
  https://docs.microsoft.com/en-us/rest/api/power-bi/embedtoken/reports_generatetoken#tokenaccesslevel
  
  I'm not sure what you mean. The link goes to "Required access level for EmbedToken generation", but I'm not using the Embed Token API.
  
  I get the token using this code:
  
  const string authorityUri = "https://login.microsoftonline.com/" + tenantId; AuthenticationContext authContext = new AuthenticationContext(authorityUri); AuthenticationResult result = null; result = await authContext.AcquireTokenAsync(resourceUri, clientCredential);
  - Anonymous
    Not applicable
    7 years ago
    v-jiascu-msft
    can any power bi pro user register an app for power bi in the below link. I have a user who is power bi admin, and he cant register an app. It throws some error related to access when registering thru this dev.powerbi.com/apps.
    https://docs.microsoft.com/en-us/power-bi/developer/register-app
    Can u help
tripleacoder
Helper I
7 years ago
I found this link:

https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal#assign-the-application-to-a-role
It talks about assigning roles to the app.

I have now granted my app the Contributor role, but only on a Resource group.
It hasn't helped. I think the Poer BI service resides at the Subscription level... that means I will need help from a global admin again.
- sjc4062
  Frequent Visitor
  7 years ago
  I had a simliar issue where i could use my own credentials but not the service account and the issue was the service account didnt have a power bi pro license. Not sure if thats the same issue but might be worth looking at
  - tripleacoder
    Helper I
    7 years ago
    sjc4062 wrote:
    I had a simliar issue where i could use my own credentials but not the service account and the issue was the service account didnt have a power bi pro license. Not sure if thats the same issue but might be worth looking at
    
    That might be it. But when I go to assign licenses and search for the service principal it does not come up in the results. Not sure if it is getting filtered away because only users and groups are valid, or if it's because I am not an Azure global admin.
v-jiascu-msft
Microsoft Employee
7 years ago
Hi tripleacoder,

It seems you only need an access token. Please refer to developer/embed-sample-for-customers.

Best Regards,
Dale
- tripleacoder
  Helper I
  7 years ago
  v-jiascu-msft wrote:
  
  It seems you only need an access token. Please refer to developer/embed-sample-for-customers.
  
  That link talks about using a special user account (username + password) for the app, not an app secret/service principal, which is what I am trying to do.
  
  However, I have been told elsewhere that roles are not needed in order to authorize service principals. Only "App permissions" are needed.
  - v-jiascu-msft
    Microsoft Employee
    7 years ago
    Hi tripleacoder,
    
    Your requirements are quite clear now. You'd like to use the App secret (aka client secret) instead of the user password authentication. I'm afraid this isn't workable in Power BI. The reason is simple. Even the global admin can't access other's contents. How can an App access everything?
    
    Best Regards,
    Dale
v-jiascu-msft
Microsoft Employee
7 years ago
Hi tripleacoder,

Could you please mark the proper answers as solutions?

Best Regards,

Dale
Anonymous
Not applicable
6 years ago
Hi All,

I am also geeting the same error when accessing power BI rest API's. I am able to generate token but not proceeding further. Can you please paste your code, which ran successfully exclusive of all tennat id and username and pwd.

Thanks & Regards
tripleacoder wrote:
I have a console app that uses the REST API to get a dataset (and later add rows to it). This works when I supply my own user/password credentials.

Now I have registered the app as a Web/API app in order to use an app key/secret instead. I can get a token, but when I make the same REST call I get 401 Unauthorized.

I have given the app the following Application permissions in Power BI Service (is this needed?):
Read and write all content in tenant
View all content in tenant
These permissions have been granted by an Azure Administrator.

In addition to the Delegated permissions that worked with user authentication:
Read and write all Datasets
View all Datasets

I have decode the two tokens.
The token for app key autentication contains this:
"roles": [
"Tenant.ReadWrite.All",
"Tenant.Read.All"
],

while the token for user based authentication contains this:
"scp": "Dataset.ReadWrite.All Workspace.ReadWrite.All",

What am I missing..?
tripleacoder wrote:
I have a console app that uses the REST API to get a dataset (and later add rows to it). This works when I supply my own user/password credentials.

Now I have registered the app as a Web/API app in order to use an app key/secret instead. I can get a token, but when I make the same REST call I get 401 Unauthorized.

I have given the app the following Application permissions in Power BI Service (is this needed?):
Read and write all content in tenant
View all content in tenant
These permissions have been granted by an Azure Administrator.

In addition to the Delegated permissions that worked with user authentication:
Read and write all Datasets
View all Datasets

I have decode the two tokens.
The token for app key autentication contains this:
"roles": [
"Tenant.ReadWrite.All",
"Tenant.Read.All"
],

while the token for user based authentication contains this:
"scp": "Dataset.ReadWrite.All Workspace.ReadWrite.All",

What am I missing..?
ironmanwk
Regular Visitor
6 years ago
My teammate been trying to get REST API to work as well but also encounter the same 401 error message. Is this still an on-going issue or there is a solution we can apply?
pvuppala
Helper V
3 years ago
Anyone got this worked out? I'm running into the same issue where we need to assign workspaces to a capacity via this POST Call
Invoke-PowerBIRestMethod -Url 'admin/capacities/AssignWorkspaces' -Method Post -body $bodyStr
This works for my ID but fails for ServicePrincipal. Is the ServicePrincipal only allowed for "Read-Only" API calls (GET method)?

Please let me know as we're trying to automate some scripts using ServicePrincipal/App ID. Not sure what we're missing.
- Anonymous
  Not applicable
  2 years ago
  Hi, did you solve it, appreciate for your response, thanks!
  - pvuppala
    Helper V
    2 years ago
    Ended up using personal account to run the PowerShell script. Eventually would like to use Power Automate via Service Principal client/secret.

Forum Discussion

Power Bi REST API - 401 Authorization error when using app secret

23 Replies

Related content

Fabric -- secrets

API secrets without Azure Key Vault

How to store secrets/access secrets using User Data Functions

Kudos and the Top Kudoed Authors widget

Handling secrets in Fabric Notebooks