Using Service Principal for REST API / Data Refresh

[akarkal]

I have a C# App that uses a Active Directory User to perform the following operations, I am trying to convert it to use a Active Directory Service Principal. I am using Power Embedded Workspace with Premium Capacity in Azure

- Create DataSet

- Create Report

- Refresh DataSet

However I am running into issues when trying to get the same actions performed using a Service Principal.

I have the following things setup 

01. Api access granted to Service Principal

 - restricted the access to a specific group and made sure that the Service Principal I am using is added to this security group

 

(Screenshot : courtesey youtube video from GuyInACube (https://www.youtube.com/watch?v=1SO19uik1rw)

02. added service principal on the workspace with the role "Admin"

03. I am using AppOwnsData project from https://github.com/microsoft/PowerBI-Developer-Samples/tree/master/.NET%20Core/Embed%20for%20your%20... and getting error

Operation returned an invalid status code 'Unauthorized'
at Microsoft.PowerBI.Api.ReportsOperations.GetReportInGroupWithHttpMessagesAsync(Guid groupId, Guid reportId, Dictionary`2 customHeaders, CancellationToken cancellationToken)
at Microsoft.PowerBI.Api.ReportsOperationsExtensions.GetReportInGroupAsync(IReportsOperations operations, Guid groupId, Guid reportId, CancellationToken cancellationToken)
at Microsoft.PowerBI.Api.ReportsOperationsExtensions.GetReportInGroup(IReportsOperations operations, Guid groupId, Guid reportId)
at AppOwnsData.Services.PbiEmbedService.GetEmbedParams(Guid workspaceId, Guid reportId, Guid additionalDatasetId) in C:\Campuslabs\TeamFoundation\PowerBI-Developer-Samples\.NET Core\Embed for your customers\AppOwnsData\Services\PbiEmbedService.cs:line 46
at AppOwnsData.Controllers.EmbedInfoController.GetEmbedInfo() in C:\Campuslabs\TeamFoundation\PowerBI-Developer-Samples\.NET Core\Embed for your customers\AppOwnsData\Controllers\EmbedInfoController.cs:line 45

My question is

1. How do I troubleshoot this issue

2. Are Service Principal Credentials allowed to refresh / create / data sets on Power Embedded Workspace with Premium Capacity

[v-shex-msft]

Hi @akarkal,

Account to your description, it seems like you missed adding the security group that you configure with the service principal as the member of power bi embedded group workspace so that the rest API can't recognize the corresponding authentication.

Please take a look at the following link to know more about these operations:

Embed Power BI content in an embedded analytics application with service principal and an applicatio...

Regards,

Xiaoxin Sheng

[akarkal · Accepted solution]

I was able to get this to work after removing the restrictions on the security group from the tenant settings

these are my settings now

- tenant : api enabled for service principal, no restrictions on security group

- SP added to workspace as administrator (directly , not via a group)

[v-shex-msft]

Hi @akarkal,

I'm glad to hear you found and share the workaround to resolve the issue. I think they may help if others faced a similar scenario.🙂 
Regards,

Xiaoxin Sheng