Service principals can access admin APIs used for updates, or can they?

[henrituol]

There seems to be a new option in Admin Portal -> Tenant settings -> Admin API Settings called "Service principals can access admin APIs used for updates". The link in the Learn More, however, takes to the same place as the Learn more of "Service principals can access read-only admin APIs".

I guess that these "APIs for updates" are other than read-only GETs, for example, PATCH Admin - Groups UpdateGroupAsAdmin or POST Admin - Groups AddUserAsAdmin. For some reason, however, I get a 401 error with these operations although I have enabled a service principal for this new option. The same service principal works fine for previously enabled read-only APIs.

Has anyone successfully utilized these admin update APIs with a service principal?  

[Michaeljel]

Facing same issue

[henrituol · Accepted solution]

Nice to know that I'm not the only one in this mess. I managed to get these responses to my support ticket: 

"We have checked with our Product team, and they confirmed that the Service principals can access admin APIs used for updates' option is still in the preview feature."

"All the admin API's will work with this new option and it will take 2 or 3 upcoming upgrades to come into effect."

Soo, probably the next year, right?

It would've been nice if there were a link to a documentation or something that said that this option isn't truly available yet.

[henrituol]

Seems to be a fairly new option. This option is mentioned in the documentation https://learn.microsoft.com/en-us/fabric/admin/tenant-settings-index#admin-api-settings and according to the Github commit, it has been added 8th of July. I wonder if anyone has succesfully used a Service Principal to use any update-related Admin APIs.

[v-rzhou-msft]

Hi @henrituol ,

To enable service principal authentication for Power BI read-only APIs, follow the steps in below offical blog:

Enable service principal authentication for read-only admin APIs - Microsoft Fabric | Microsoft Lear...

Here are the support api: Support Apis

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[henrituol]

Read-only APIs work just fine. I'm talking about the new option "admin APIs used for updates".