Forum Discussion
Power Bi REST API - 401 Authorization error when using app secret
Hi tripleacoder,
As far as I know, the permissions of Power BI are all based on the users. So an App can't act as a user. Please refer to developer/power-bi-permissions where all the descriptions have "user".
Regarding "Tenant.ReadWrite.All", the documentation above also has a description. Actually, these permissions only can retrieve the profiles rather than data. Please refer to admin/reports_getreportsasadmin.
One simple proof we can see is that even an admin can't access all the App workspaces. The data is the precious asset of a company. I think this is reasonable.
Best Regards,
Dale
Hi tripleacoder,
It seems you only need an access token. Please refer to developer/embed-sample-for-customers.
Best Regards,
Dale
v-jiascu-msft wrote:
It seems you only need an access token. Please refer to developer/embed-sample-for-customers.
That link talks about using a special user account (username + password) for the app, not an app secret/service principal, which is what I am trying to do.
However, I have been told elsewhere that roles are not needed in order to authorize service principals. Only "App permissions" are needed.
Hi tripleacoder,
Your requirements are quite clear now. You'd like to use the App secret (aka client secret) instead of the user password authentication. I'm afraid this isn't workable in Power BI. The reason is simple. Even the global admin can't access other's contents. How can an App access everything?
Best Regards,
Dale
v-jiascu-msft wrote:Your requirements are quite clear now. You'd like to use the App secret (aka client secret) instead of the user password authentication. I'm afraid this isn't workable in Power BI. The reason is simple. Even the global admin can't access other's contents. How can an App access everything?
Thanks. This MS sample posts data to a custom Web API using the same method (but with a custom role):https://azure.microsoft.com/en-us/resources/samples/active-directory-dotnet-daemon/
Can you explain a bit more why that won't work with the Power BI REST API? Perhaps also with a link to some documentation...
The app has the permission (=role) "Tenant.ReadWrite.All" which I supposed was for this purpose.
Hi tripleacoder,
As far as I know, the permissions of Power BI are all based on the users. So an App can't act as a user. Please refer to developer/power-bi-permissions where all the descriptions have "user".
Regarding "Tenant.ReadWrite.All", the documentation above also has a description. Actually, these permissions only can retrieve the profiles rather than data. Please refer to admin/reports_getreportsasadmin.
One simple proof we can see is that even an admin can't access all the App workspaces. The data is the precious asset of a company. I think this is reasonable.
Best Regards,
Dale
This is false information and should be removed.
Microsoft must do a better job maintaining it's forums. The misinformation on the internet here is thick.
While this may have been true in 2019, it's not true today, and misleading search results.