Update DataSource parameter with API

[udione]

I'm trying to update DataSource Parameters with this code:

string scope = "https://analysis.windows.net/powerbi/api/.default";

IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
                .WithClientSecret(clientSecret)
                .WithAuthority(new Uri(authority))
                .Build();

string[] scopes = new string[] { scope };

AuthenticationResult result = null;
result = await app.AcquireTokenForClient(scopes).ExecuteAsync();

PowerBIClient pbiClient = new PowerBIClient(new Uri("https://api.powerbi.com/"), new TokenCredentials(result.AccessToken, "Bearer"));

var refds = await pbiClient.Datasets.UpdateParametersInGroupWithHttpMessagesAsync(_groupId, _datasetId, new UpdateMashupParametersRequest(new UpdateMashupParameterDetails("orgId", "98")));

I get: Operation returned an invalid status code 'Forbidden'

I've turned on every possible setting in Tenant Settings in Power BI and Api privileges for App Registration in Azure.

I'm new, trying things out as Pro Licence without any reserverd capacity in Azure Power Bi Embedded - is that necessary? 

[udione]

I'm using app-only access, so no delegated permissions.

[lbendlin]

this may help

Microsoft Azure AD JWT Token is missing Scope information - Microsoft Q&A

[udione]

Does this imply that I can only methods like 

UpdateParametersInGroupWithHttpMessagesAsync

only if I get user access token and cannot just use token quired using only applicattion secret?

[lbendlin]

no scope = no worky

[udione]

I've changed that now my user (which is admin in PowerBI) is used for fetching access token.

I can execute methods like pbiClient.Datasets.GetDatasetsInGroup

But when executing pbiClient.Datasets.UpdateParametersInGroupWithHttpMessagesAsync

I still get Forbidden result. 

Decrypted token in jwt.io still does not have scp.

[lbendlin]

take your token to jwt.io and examine the "scp"  (scope)  section.  Most likely the token is hollow.

[udione]

There is no scp section at all in the token. How can I fixed that? 

[lbendlin]

go back to your app registration and ask for better permissions.

[udione]

I've already turned on in azure everything that is related to Power Bi for the app. Can you advise which specific permissions it needs ?

[lbendlin]

Did you delegate?

[udione]

Sorry, but what exactly do you mean by delegate?

[lbendlin]

Have you asked for straight permissions or delegated permissions?