Hello,
I am having trouble executing the "ExecuteQueries In Group" PowerBI API for Datasets.
Here's what I did:
Microsoft Entra ID:
1. Create an App Registration with the name "PowerBI-SP".
2. Created a Client Secret with extended validity. Using the secret value as the client secret.
2. Added the following Delegated API Permissions with no admin consent required: "Dataset.Read.All Dataset.ReadWrite.All"
3. Created a MS Entra Security Group with the name "Group For PowerBI SPs".
4. Added App Registration "PowerBI-SP" as the member of the MS Entra Security Group "Group For PowerBI SPs".
PowerBI Admin Portal:
1. Under "Integration Settings", enabled the "Dataset Execute Queries REST API" option.
2. Applies to "the entire organization". No need to whitelist my MS Entra Security Group.
3. Under "Developer Settings", enabled the "Allow Service Principals to use the PowerBI/Fabric APIs" option.
4. Applies to "Specific Security Groups" with my MS Entra Security Group "Group For PowerBI SPs" whitelisted.
Fabric/PowerBI Service:
1. Added my MS Entra Security Group "Group For PowerBI SPs" as the "Member" of the workspace that I am trying to read the data from.
2. Gave the MS Entra Security Group "Group for PowerBI SPs" the access of "read, build" permissions on the dataset/semantic-model that I am trying to query the data from, using DAX.
Generate Access Token:
1. Token Endpoint V2: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token
2. Content-Type: x-www-form-urlencoded
3. Request Body: client_id={client_id}&client_secret={client_secret}&grant_type="client_credentials"&scope="https://analysis.windows.net/powerbi/api/.default"
ExecuteQueries in Group API: Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn
1. Endpoint: https://api.powerbi.com/v1.0/myorg/groups/{group_id}/datasets/{dataset_id}/executeQueries
2. Authorization: "Bearer {access_token}"
3. Request Body: A valid Json with a valid DAX.
Example: "{
"queries": [
{
"query": "EVALUATE VALUES(MyTable)"
}
],
"serializerSettings": {
"includeNulls": true
}}"
Response:
ERROR: 401 Unauthorized
{
"error": {
"code": "PowerBINotAuthorizedException",
"pbi.error": {
"code": "PowerBINotAuthorizedException",
"parameters": {},
"details": [],
"exceptionCulprit": 1
}
}
}
Observations:
1. ExecuteQueries In Group API works with my own Access Token. I am just a member in the Workspace. I have same permissions as the Service Principal.
2. DAX is valid. I have verified everything with my own access token. It returns the data well within the limitations of the API.
3. I tried generating the access token using both v1 and v2 token endpoints with valid resource and scope values. I keep getting the same error "PowerBINotAuthorizedException". resource_v1=https://analysis.windows.net/powerbi/api, scope_v1="Dataset.Read.All Dataset.ReadWrite.All" 4. Service Principal Manifest has listed entries of all alloted API permissions, stated as above.
5. All Workspace and Dataset permissions have been verified and reverified but to no avail.
6. Added my MS Entra Security Group as the Admin of the workspace as well with all permissions on the dataset to no avail.
7. All ids used in this process are correct, be it dataset id, group id, client id, etc.. I have verified 100 times.
8. Both RLS and SSO are disabled on the dataset.
9. Also tried giving "SemanticModel.Read.All", "Semantic.Model.ReadWrite.All" and just about any other permission that does not require admin consent to no avail.
I followed all instructions presented in the MS Docs and some, still getting the same error.
What am I missing?
Any help would be appreciated.
Thanks
