Forum Discussion
401 Unauthorized when calling Power BI Admin Add User API with Service Principal (Fabric Administrat
Hi AbdelmonemKaabi ,
To clarify, a Service Principal does not need to be a workspace Admin to use:
POST /admin/groups/{workspaceId}/usersThis API works with apponly authentication and is designed for tenant level automation scenarios like yours.
Since Admin read APIs are functioning and your script runs successfully locally, the 401 error indicates the identity or token used during the Azure Automation run is not being authorized.
Please check that the Service Principal used in Automation:
1. Is the same Client ID assigned the Fabric Administrator role & Is part of the tenant setting security group
2. Receives a token with Tenant.ReadWrite.All
3. Uses the Application (Client) ID, not the Object ID, as the identifier
There are no known Fabric side restrictions preventing this method.
Regards,
Yugandhar
what's the scp of your acquired token?
I currently have only Microsoft Graph permissions: Application permissions (InformationProtectionPolicy.Read.All and User.Read.All) and Delegated permission (User.Read). I then added the Power BI application permission (Tenant.ReadWrite.All), and after that, the script no longer works. The token does contain roles.
My goal is to create a PowerShell script that backs up all Power BI workspaces.
Currently, the script only works if I manually add the service principal (SP) to each workspace. In our company, we have more than 60 workspaces, and sometimes new workspaces are created without informing me. As a result, some backups are missing.To solve this, I created a script that retrieves all workspaces automatically. However, when the script tries to add the service principal as a member to a workspace, it fails with a 401 Unauthorized error. The script is running from an Azure Automation Runbook.
I currently have only Microsoft Graph permissions: Application permissions (InformationProtectionPolicy.Read.All and User.Read.All) and Delegated permission (User.Read). I then added the Power BI application permission (Tenant.ReadWrite.All), and after that, the script no longer works. The token does contain roles.
My goal is to create a PowerShell script that backs up all Power BI workspaces.
Currently, the script only works if I manually add the service principal (SP) to each workspace. In our company, we have more than 60 workspaces, and sometimes new workspaces are created without informing me. As a result, some backups are missing.To solve this, I created a script that retrieves all workspaces automatically. However, when the script tries to add the service principal as a member to a workspace, it fails with a 401 Unauthorized error. The script is running from an Azure Automation Runbook.
I currently have only Microsoft Graph permissions: Application permissions (InformationProtectionPolicy.Read.All and User.Read.All) and Delegated permission (User.Read). I then added the Power BI application permission (Tenant.ReadWrite.All), and after that, the script no longer works. The token does contain roles.
My goal is to create a PowerShell script that backs up all Power BI workspaces.
Currently, the script only works if I manually add the service principal (SP) to each workspace. In our company, we have more than 60 workspaces, and sometimes new workspaces are created without informing me. As a result, some backups are missing.To solve this, I created a script that retrieves all workspaces automatically. However, when the script tries to add the service principal as a member to a workspace, it fails with a 401 Unauthorized error. The script is running from an Azure Automation Runbook.
