Refreshing a Dataset Error 401 Unless Using access_token from Microsoft Learn

[WilkerFRL94]

Hi!

I need help setting up a Dataset refresh via API.

I'm developing it via Python, so i can integrate it with other processes we have already automated here.

Right now, my code is able to refresh the Dataset if i use the access_token i can get from the Datasets - Refresh Dataset In Group page at Microsoft Learn. So the Dataset parameters like group_id and dataset_id, and the POST themselves are good and the problem is how to get the correct token to use in the request.

But seems like the access_token i get within code doesn't work, it results in error 401 with no text.

Right now, i'm using this to get the access token:

# Get Access Token
token_url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/token"
token_data = {
    'grant_type': 'client_credentials',
    'client_id': client_id,
    'client_secret': client_secret,
    'resource': 'https://analysis.windows.net/powerbi/api'
}
token_r = requests.post(token_url, data=token_data)

The fields tenant_id, client_id and client_secret i get from the App i've created at Microsoft Azure. So far i've made sure to check all these fields are correct and i've made sure they have the "Workspace.ReadWrite.All" permission:

And the result for it is a token that seems right, as seen in the format page. Also, this makes me think the App configuration is right, since i set up the App and secrets and they give a response.

The remaining code is:

refresh_url = f"https://api.powerbi.com/v1.0/myorg/groups/{group_id}/datasets/{dataset_id}/refreshes"


# Trigger manual refresh
headers = {
    'Content-Type': 'application/json',
    'Authorization': f'Bearer {access_token}'
}

# Request body
payload = {
    'notifyOption': ''
}

refresh_response = requests.post(refresh_url, headers=headers, json=payload)

# Check response status
if refresh_response.status_code == 202:
    print("Manual refresh triggered successfully!")
else:
    print(f"Failed to trigger refresh. Status code: {refresh_response.status_code}")
    print(f"Error message: {refresh_response.text}")

And as before, the group and dataset id, and access token are all passed as variables within the code.

I've tried to get the token with another method:

import adal
# Your credentials 
tenant_id = '...'
client_id = '...'
client_secret = '...'
username = "...@domain.com.br"
password = "..."

# URLs
authority_url = 'https://login.microsoftonline.com/common'
resource_url = 'https://analysis.windows.net/powerbi/api'

# Authentication context setup
context = adal.AuthenticationContext(authority=authority_url, validate_authority=True, api_version=None)

try:
    token = context.acquire_token_with_client_credentials(resource=resource_url, client_id=client_id, client_secret=client_secret)
    access_token = token.get('accessToken')
    print(f"Access Token: {access_token}")
except adal.AdalError as e:
    print(f"An error occurred: {e}")

The code above leads me into this:

An error occurred: Get Token request returned http error: 400 and server response: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier '...' was not found in the directory 'Microsoft Services'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. 

(...)

"error_uri":"https://login.microsoftonline.com/error?code=700016"}

EDIT: I've found out what was wrong with this part, that's the "common" instead of my tenant_id in the authority_url. But still, although i get a token, the response i'll get from the POST with it is still 401 with no text.

I'm not sure if i'm missing something, cause it will work with the access_token from Microsoft Learn API test, but i'm stuck with getting the correct access_token within the code.

Thanks in advance.

[tackytechtom]

Hi @WilkerFRL94 ,

Yeah, it seems like you do not have admin rights. These settings can be found in the Tenant settings. Also, it probably makes sense to create a security group with your service principal in it so they do not need to enable it for the whole organization and can manage access on a more granular level by giving API permissions only to certain service principals.

Let me know how everything goes 🙂

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/

[WilkerFRL94]

Right. This may take a while (and that's why usually i'll just keep searching for answers online).

I also checked a few more examples and found out that maybe i was missing the "scope" parameter when requesting the token, at the start. I set this up:

scope = "https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All/.default"

# Get Access Token
token_url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/token"
token_data = {
    'grant_type': 'client_credentials',
    'client_id': client_id,
    'client_secret': client_secret,
    'scope': scope
}

And with this new token i get the 403 error code (no text) when doing the refresh POST.

I'm also wondering if it could be related to API being disabled by the tenant admin, cause with the token from the Learn page it works fine.

[tackytechtom]

Hi @WilkerFRL94 ,

Have you enabled this one here?

Note, the screenshot might look a little bit diifferent now.

/Tom
https://www.tackytech.blog/
https://www.instagram.com/tackytechtom/

[WilkerFRL94]

Hi @tackytechtom!

No, i haven't seen this step before. 

I tried to find it, but i don't see those options, all i get is the capacity settings and refresh summary options.

Meanwhile i'm checking with the IT admin here, cause i believe they might have disabled some features, and maybe that's why a few of these options don't show up for me?