Forum Discussion

AbdelmonemKaabi's avatar
AbdelmonemKaabi
Frequent Visitor
6 months ago
Solved

401 Unauthorized when calling Power BI Admin Add User API with Service Principal (Fabric Administrat

  Hello everyone, I’m trying to add a Service Principal as Contributor to all Power BI workspaces using the Admin REST API, but I consistently receive HTTP 401 Unauthorized, even though all require...
admin
capacities
one lake
security
workspaces
  • V-yubandi-msft's avatar
    V-yubandi-msft
    6 months ago

    Hi AbdelmonemKaabi ,

    To clarify, a Service Principal does not need to be a workspace Admin to use: 

    POST /admin/groups/{workspaceId}/users

    This API works with apponly authentication and is designed for tenant level automation scenarios like yours.

     

    Since Admin read APIs are functioning and your script runs successfully locally, the 401 error indicates the identity or token used during the Azure Automation run is not being authorized.

    Please check that the Service Principal used in Automation:

    1. Is the same Client ID assigned the Fabric Administrator role & Is part of the tenant setting security group

    2. Receives a token with Tenant.ReadWrite.All

    3. Uses the Application (Client) ID, not the Object ID, as the identifier

     

    There are no known Fabric side restrictions preventing this method.

     

    Regards,
    Yugandhar

V-yubandi-msft's avatar
V-yubandi-msft
Community Support
6 months ago

Hi AbdelmonemKaabi ,

Thanks for sharing more details. The 401 Unauthorized error isn’t caused by the script or token acquisition, but by the way Power BI Admin APIs handle service principal authentication. Service principals can access admin read APIs like GetGroupsAsAdmin, which is why listing workspaces works as expected.

However, update operations such as

POST /admin/groups/{id}/users

aren’t supported with app only authentication and require a delegated user identity instead of a service principal token. This is why you see the 401 error, even though the service principal is a Fabric Administrator and the Admin API tenant settings are enabled. 

 

To add the service principal to workspaces, use a delegated admin accoun. Once added, the service principal can automate tasks such as backups in those workspaces.

FYI:

 

For further details, please refer to the attached Microsoft documentation.

Admin - Groups GetGroupsAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn

 

Regards,
Yugandhar.