Push DataSet API with Service Principle Authentication

[weeverjames]

The customers of my company's SaaS application want us to push their data from our service to Power BI.

I would like to do that from our server directly but I'm running into issues. We've registered an application that requests the Tenant.ReadWrite.All role on the Power BI service and have the authentication flow set the permission to the Application type. That works fine but any call I make with an access token to the Power BI Push DataSet APIs results in a 403:

{
  "Message": "API is not accessible for application"
}

I've created a security group in my testing tenant, added the service principle as a member, and set the developer tenant settings to allow members of the security group access to workspaces in Power BI.

However I've also read that the Push DataSet APIs only work with "My Workspace" and under service principle authentication it appears that service principles are not allowed to work with "My Workspace."

So it seems like this is a dead end. Is there a way for a server-side application to push data to a tenant in Power BI without requiring every user to manually trigger and authorize each request?

[weeverjames · Accepted solution]

I think I am right about service principles being restricted from using operations on endpoints that operate on "My Workspace."

One point of confusion that may trip someone up is that "groups" in the API are "Workspaces" in Power BI.

I get a 500 error if I try to create a group through the service principle. If I understand the restrictions on service principles if creating a group is an "admin" action then this might be a 403 error in disguise, does that sound right?

I've found that it's possible to create datasets, tables, and rows in "groups" using this authentication method.