Forum Discussion

higgy7's avatar
higgy7
Icon for Advocate II rankAdvocate II
1 year ago
Solved

FUAM Load_FUAM_Data_E2E error

I am having real issues with permissions.   We have a service principle account with no permissions as stated in the documentation.   We have assigned it to a security group and gave the security...
admin
  • higgy7's avatar
    higgy7
    1 year ago

    Just an update on this. I discovered my issue was that the group with the SP account in it was not a member of the Admin Monitoring Workspace. When i added the group to this the pipeline ran successfully.

     

    You do not need to add ANY permissions to the SP account in Azure.

higgy7's avatar
higgy7
Icon for Advocate II rankAdvocate II
1 year ago

Thank you i will give this a go. However, the instructions are not very clear then as it says 

  • Create a new service principal with client secret within Azure Entra ID, without any API permissions.

It specifically says without any api permissions then in your instructions you are assigning api permissions? Should the github not say what permissions need added instead of don't give any permissions ?

 

 Step 2: Assign API Permissions

  1. In the app you just registered, go to API permissions
  2. Click Add a permission > APIs my organization uses
burakkaragoz's avatar
burakkaragoz
Icon for Super User rankSuper User
1 year ago

Great catch, and I totally get why that might seem confusing.

Here’s the clarification:

When the documentation says the service principal should have “no permissions,” it usually refers to not assigning any user-level roles or workspace access manually at first — especially when testing token generation or basic connectivity.

However, for the service principal to actually call Fabric or Power BI APIs, it absolutely needs API permissions assigned in Azure AD (Step 2 in the guide). These are application-level permissions like Tenant.Read.All or Capacity.Read.All, and they must be granted with admin consent.

So in short:

  • No user-level roles initially → to keep the setup clean and testable
  • Yes to API permissions → required for the token to work with Power BI endpoints

Let me know if you want me to walk through the permission scopes or show how to verify them in Azure.

  • higgy7's avatar
    higgy7
    Icon for Advocate II rankAdvocate II
    1 year ago

    Thanks for this, i guess my query then is isn't the permission applied via the following:

     

    So within the admin settings of Fabric/Power BI rather than within the app registration? If this is the case i have added the SP to a security group and then added the group to the 2 settings stated