REST API using MS Entra ID App

[swapnil-saxena]

Hi,

I'm experimenting with triggering MS Fabric REST API using MS Entra ID App as suggested in below doc:

https://learn.microsoft.com/en-us/rest/api/fabric/articles/get-started/fabric-api-quickstart

I have created an Entra App and provided required required API and workspace level permissions.
Using Postman, I trigger the REST API endpoint for Get Item endpoint but I couldn't get the token for the mentioned scope: https://api.fabric.microsoft.com/Item.Read.All 

So, I tried with scope: "https://analysis.windows.net/powerbi/api/.default", which worked. I could get the initial token but when I tried the next step to get details for a particular Fabric item, I get below authentication error.

"The caller is not authenticated to access this resource"

I'm not sure if I'm using the right parameters. Can someone suggest the right parameters that I can use here?

Thanks.

[SivaSubramanian]

Hi @swapnil-saxena Have you got any solution regarding this , I'm also facing this same issues right now.

[swapnil-saxena]

Not yet. A few endpoints work from inside notebooks but I'd really like these to be working through external apps via SPNs. 

[AnandGNR]

@swapnil-saxena :   Hi Swapnil,  Just wanted to check in to see if there have been any updates regarding your ticket. I'm encountering the exact same issue where the returned token is generating an "Unable to process the operation due to an error in the request" message while trying to use the Shortcuts API . 

Thanks,

Anand

[swapnil-saxena]

I haven't yet got a resolution on this. This is still being investigated.

[HimanshuS-msft]

Hello @swapnil-saxena , 
I was able get the token using Postman . May be this helps .

[swapnil-saxena]

Thanks. I was using the v2 url to get the token. I fixed it with the one that you suggested and I can get the token now. But it doesn't seem to work with any of the REST endpoints. Getting 

"message": "Unable to process the operation due to an error in the request"

Can you also similarly show params for any endpoint that works for you? I'm particularly interested in these two: Get Item and Job Scheduler - Run On Demand Item Job

[frithjof_v]

I think you only need one header parameter, Authorization.

If your token is 12345 then the value you enter in the Authorization header should be Bearer 12345.

Thus, you need to add Bearer in front of the token.

https://pbi-guy.com/2023/03/25/connect-with-power-bi-to-the-power-bi-rest-api-with-a-service-princip...

That worked for me with the endpoints I mentioned

You also need to make sure that you gave the app registration permissions to read the required scopes in the API permissions page in the App registration in Azure portal.

I agree there seems to be some contradiction in the documentation regarding whether or not service principal is supported. In my experience, currently service principal authentication doesn't work for the Lakehouse endpoint, but it works for the endpoints I mentioned.

[v-gchenna-msft]

Hello @swapnil-saxena ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .
In case if you have any resolution please do share that same with the community as it can be helpful to others .
Otherwise, will respond back with the more details and we will try to help .

[swapnil-saxena]

Hi,

So far, I'm not able to get this working for the endpoints that I mentioned in my response. Looking at the expert responses, I'm not sure if this has a definite solution given the limitations of using SPN or any other possible alternatives.

[frithjof_v]

Just to confirm: did any endpoints work?

Btw, I agree support for SPN is needed on all endpoints

[swapnil-saxena]

Nope. I'm not able to get it working for any of the endpoints, unfortunately. I can get the token generated but further to that all the endpoints bring back the same error message: 

"message": "Unable to process the operation due to an error in the request"

[v-gchenna-msft]

Hi @swapnil-saxena ,

Apologies for the issue you have been facing.  If its a bug, we will definitely would like to know and properly address it.

Please go ahead and raise a support ticket to reach our support team: support-ticket-link

After creating a Support ticket please provide the ticket number as it would help us to track for more information.

Thank you.

[swapnil-saxena]

Thank you, I'm not sure if this is a bug. There's definitely some contradiction in the docs as mentioned by the experts above. Meanwhile, I'll raise a support request from my side to have this examined thoroughly.

[v-gchenna-msft]

Hi @swapnil-saxena ,

Can you please provide the ticket number as it would help us to track for more information?

[swapnil-saxena]

Please see the support ticket number: Case 2402020030000891 

[frithjof_v]

Fabric REST API does not support service principal yet, it may be the reason?

https://learn.microsoft.com/en-us/rest/api/fabric/articles/using-fabric-apis#considerations-and-limi...

In my experience, some endpoints work with service principal, and some don't at the moment.

I am able to use the List Capacities, List Workspaces, List Items and some other endpoints. Do you get success if you try to call any of those endpoints?

[swapnil-saxena]

Thanks for the reply. I noticed about SPN support earlier, however, it just doesn't add up with what's mentioned in this doc:

https://learn.microsoft.com/en-us/rest/api/fabric/articles/get-started/fabric-api-quickstart

Isn't this contradictory to "SPN being unsupported" or am I misinterpreting this?

I'm trying to trigger Get Item and Job Scheduler - Run On Demand Item Job endpoints but none work in addition to the ones that you mentioned. Getting

"message": "Unable to process the operation due to an error in the request"