Problems with service principal profiles for multitenancy apps

[leonids2005]

I am trying to setup PowerBI embedded to work with service principal profiles with
multi-tenant app.

Trying to follow the documentation but there are many, not clear things, and here is what I have done:

• Set up the service principal - Done
• From a Power BI tenant admin account, enable creating profiles in the tenant - Done
• Created profile - Done
• Question 1. The statement below is not very clear - in a sense, should I do anything
  specific?
  Any API that grants a user permission to Power BI items can also grant a
  profile permission to Power BI items. For example, Add Group User API can
  be used to grant profile permission to a workspace.
• Created Workspace - Done
• Assigned the workspace to a capacity - Done
• Problems
  •  trying to import reports
    Got
    {
    "error": {
    "code": "ItemNotFound",
    "message": "Unable to perform the requested operation. The workspace with the ID 'XXXXXX' either does not exist or you don't have access permissions."
    }
    }
    But I have provided the correct workspace ID which I recently created earlier
  • I have also tried Get Imports in a workspace/group
    got
    {
    "error": {
    "code": "PowerBINotAuthorizedException",
    "pbi.error": {
    "code": "PowerBINotAuthorizedException",
    "parameters": {},
    "details": [],
    "exceptionCulprit": 1
    }
    }
    }
  • tried to add service principal (assign admin rights)
    and again got "Not Found"
    {
    "error": {
    "code": "PowerBIEntityNotFound",
    "pbi.error": {
    "code": "PowerBIEntityNotFound",
    "parameters": {},
    "details": [],
    "exceptionCulprit": 1
    }
    }
    }

Honestly a bit stuck. Documentation is not very detailed so any help is appreciated

[leonids2005]

thank you, I think I have tried it already. But I will go through my notes again and see, possibly try again.

Yes, that was one thing I have tried

https://api.powerbi.com/v1.0/myorg/groups/edaf2dae-8af5-4a5c-b74a-XXXXXXX/users

{

  "identifier": "1bc29484-fbdb-43e1-8715-XXXXXXX",

  "groupUserAccessRight": "Contributor",

  "principalType": "App",

  "profile": 

    {

        "id": "32f34566-f232-4754-b7ae-XXXXXXX"

    }

}

And got this 

{

    "error": {

        "code": "PowerBIEntityNotFound",

        "pbi.error": {

            "code": "PowerBIEntityNotFound",

            "parameters": {},

            "details": [],

            "exceptionCulprit": 1

        }

    }

}

[AmosHersch]

Hi @leonids2005 ,

I suspect that the reason to the errors you've received is related to that statement which you couldn't fully understand.

When a regular user / Service principal wants to perform an operation in a workspace, for example import a report to a workspace, you have to first give him permissions (member/admin/...) to the workspace. So the same goes to the Service Principal Profile you've created. If he doesn't have permissions in the workspace then such operations are expected to fail.

So buttom line - I belive you're missing the step of adding the profile to the workspace.

Thanks,

Amos