Why does PowerBI custom connector need "ReadWrite.All" permissions?

[CCal]

Hi, 

Just starting out to build and test a PowerBI custom connector to grab data from Azure AD. 
For testing purposes, the connector goes to this endpoint: https://graph.microsoft.com/beta/users and grab all the data and import that into PowerBI.

I added the connector to the data gateway for auto refresh and it works, but when I remove these two delegated permissions (Group.ReadWrite.All and User.ReadWrite.All), the auto refresh fails. If I added back the Write permissions, the refresh works again.

Since it is just reading information, wouldn't the Group.Read.All and User.Read.All permissions be sufficient?

Anyone have an idea why a Write permission is needed?

[v-rzhou-msft · Accepted solution]

Hi @CCal ,

I think we need write permission to refresh dataset successfully.

Most of the operations in the Power BI Service are basically supported by calls using the API. You can refer to the refresh APIs to make sure what permission you need to.

For reference:

Datasets - Refresh Dataset

Best Regards,

Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.