how to get data about users from powerbi rest api without been administrator

[Toi69___]

Hello all,

I looking for a solution to get evant activity ou audit log from power bi rest api or azure.
I created a application on azure, a service principal and a secret.
A have thoses permissions too :
Microsoft Graph
- user.read.all (delegated and appli)
- auditlog.read.all (delegated and appli)
- directory.read.all (delegated and appli)
- report.read.all (delegated and appli)
Power BI Service
Tenand.read.all

A still have error messages when a tried to get data about activityevent from power bi resta pi or auditlog from azure.

Important information, i do not have a administrator role.

If someone have some informations about that thank to all

[v-lgarikapat]

Hi @Toi69___ ,

Thanks for reaching out to the Microsoft fabric community forum.

@rohit1991 , @Poojara_D12 , @lbendlin  

Thanks for your prompt response

@Toi69___ 

I wanted to follow up and confirm whether you’ve had the opportunity to review the information  provided super users . Should you have any questions or require further clarification, please don't hesitate to reach out.

We appreciate your engagement and thank you for being an active part of the community.

Best Regards,

Lakshmi Narayana

[rohit1991]

Hi @Toi69___ ,
You're encountering errors when trying to access Power BI activity events or Azure audit logs via the REST API because, even though your Azure application has the correct API permissions (such as AuditLog.Read.All, Directory.Read.All, and Tenant.Read.All), accessing this type of sensitive organizational data requires elevated privileges. Specifically, Microsoft enforces that only users with either the Power BI Service Administrator role or Microsoft 365 Global Administrator role can retrieve audit logs and activity event data.

This applies whether you're using delegated permissions (on behalf of a signed-in user) or application permissions via a service principal. Without one of these admin roles, the APIs will block access, regardless of the app's permission grants.

To move forward, you would either need an administrator to grant consent on behalf of the organization and assign the appropriate admin role to your service account, or request that an admin run the query and provide the data you need. Unfortunately, there's no workaround to bypass this requirement, as it's a security restriction built into Microsoft’s auditing and compliance controls.

[Poojara_D12]

Hi @Toi69___ 

You're attempting to access Power BI activity events or audit logs using the Power BI REST API or Microsoft Graph API by leveraging an Azure AD app registration with a service principal and secret. You've correctly assigned both delegated and application-level permissions such as AuditLog.Read.All, Directory.Read.All, Report.Read.All, and Tenant.Read.All, which are required to query audit and activity data. However, despite this setup, you're encountering errors when trying to retrieve the activity data, and the key limitation here is that you do not hold an administrator role in your tenant.

This is important because accessing audit logs—whether through the Power BI REST API (GetActivityEvents) or Microsoft Graph API (/auditLogs)—requires elevated privileges that only users in certain administrative roles can exercise. Specifically, you need to be assigned a role such as Global Administrator, Compliance Administrator, Security Administrator, or Report Reader with audit log access. Without this, even though your app technically has the required API permissions, the underlying user context or service principal identity is not authorized to access tenant-level audit data.

In summary, the error you’re facing is due to insufficient directory-level permissions tied to your role, not just the API permissions in Azure. To resolve this, you’ll need to request that a tenant administrator either:

Assign you an appropriate admin role (like Compliance Admin), or

Set up a separate service principal account with the required role and permissions, and use that identity for your API calls.

Without admin role privileges, Microsoft blocks access to sensitive logs for security and compliance reasons, regardless of the app permissions granted in Azure AD.

[Toi69___]

Thank you for this overview.
I still have a question when you say :

"Set up a separate service principal account with the required role and permissions, and use that identity for your API calls."

I do not understand beacause when a make ma api call, i use my service principal informations to get data.

Here this is my python witch give me the token :

import msal

import requests

import pandas as pd

# === Paramètres ===

TENANT_ID = 'my tenant id'

CLIENT_ID = 'my client id of my enterprise application'

CLIENT_SECRET = 'My secret '

GRAPH_SCOPE = ['https://graph.microsoft.com/.default']

# === Authentification ===

def get_graph_access_token():

    app = msal.ConfidentialClientApplication(

        client_id=CLIENT_ID,

        authority=f"https://login.microsoftonline.com/{TENANT_ID}",

        client_credential=CLIENT_SECRET

    )

    result = app.acquire_token_for_client(scopes=GRAPH_SCOPE)

    if "access_token" in result:

        return result['access_token']

    else:

        raise Exception(f"Échec de l'authentification : {result}")

# === Script principal ===

if __name__ == "__main__":

    token = get_graph_access_token()

With this a can get data for microsoft graph api in is v1.0 version but for the auditlog i need to use the beta version and at this time i receive a error.

So if i understand i receive a token witch is connecting to my service principal so in this case a should not have error of permissions ?

Do i understand correct ?
If not coult you give me the solution to use my service principal correcty ?

Thank you @Poojara_D12 

[lbendlin]

Important information, i do not have a administrator role.

Then you will not have access to these API endpoints.