Forum Discussion
Advocate IIFUAM Load_FUAM_Data_E2E error
Just an update on this. I discovered my issue was that the group with the SP account in it was not a member of the Admin Monitoring Workspace. When i added the group to this the pipeline ran successfully.
You do not need to add ANY permissions to the SP account in Azure.
Super UserGreat catch, and I totally get why that might seem confusing.
Here’s the clarification:
When the documentation says the service principal should have “no permissions,” it usually refers to not assigning any user-level roles or workspace access manually at first — especially when testing token generation or basic connectivity.
However, for the service principal to actually call Fabric or Power BI APIs, it absolutely needs API permissions assigned in Azure AD (Step 2 in the guide). These are application-level permissions like Tenant.Read.All or Capacity.Read.All, and they must be granted with admin consent.
So in short:
- No user-level roles initially → to keep the setup clean and testable
- Yes to API permissions → required for the token to work with Power BI endpoints
Let me know if you want me to walk through the permission scopes or show how to verify them in Azure.
Advocate IIThanks for this, i guess my query then is isn't the permission applied via the following:
So within the admin settings of Fabric/Power BI rather than within the app registration? If this is the case i have added the SP to a security group and then added the group to the 2 settings stated