Add Connection Role Assignment to ServicePrincipalProfile type

[nguidoux]

According to the add connection role documentation it looks like the ServicePrincipalProfile type should be able to be added to a connection with a role.
https://learn.microsoft.com/en-us/rest/api/fabric/core/connections/add-connection-role-assignment?ta...

Any request to add a role to a connection for a ServicePrincipalProfile type results in a BadRequest. There are no details given as to why it is a bad request. It does not seem to matter what role is assigned.

Example request that results in a 400

https://api.fabric.microsoft.com/v1/connections/f3a2e6af-d048-4f85-94d9-b3d16140df05/roleAssignments

{
  "principal": {
    "id": "6a002b3d-e4ec-43df-8c08-e8eb7547d9dd",
    "type": "ServicePrincipalProfile",
    "servicePrincipalProfileDetails": {
      "parentPrincipal": {
        "type": "ServicePrincipal",
        "id": "12ed1a62-05f2-4e13-a2ad-047ac5934d33"
      }
    }
  },
  "role": "Owner"
}

I have been able to successfully assign the Admin role to a Workspace for Service Principal Profiles.
https://api.fabric.microsoft.com/v1/workspaces/{workspaceId}/roleAssignments

[v-veshwara-msft]

Hi @nguidoux ,

Thanks for posting in the Microsoft Fabric Community.

It may be that assigning a Service Principal Profile to a connection is not supported at this time, even though the API schema shows that type. This could explain why the request returns a BadRequest.

For Service Principal Profiles, the supported option seems to be at the workspace level, where they can be added but only with Admin rights.
Reference: Solved: Add Service Principal Profile as anything but Admi... - Microsoft Fabric Community

Document: Use service principal profiles to manage customer data in multitenant apps - Power BI | Microsoft Le...

If this is something you need for connections, it may help to raise a support ticket with Microsoft for further clarification.

Hope this helps. Please reach out for further assistance.

Thank you.

[v-veshwara-msft]

Hi @nguidoux ,
Just wanted to check if the response provided was helpful. If further assistance is needed, please reach out.

Further, if you have raised a support ticket and got any resolution, please share here so that it would be helpful for others who are following this thread.
Thank you.

[tharunkumarRTK]

I guess you are trying to add an SPN to a gateway connection by calling an API. 

If yes, then please check whether you have sufficient permissions to do so, as per the documentation, these permissions are needed : "The caller must have UserWithReshare or higher role on the connection or be an Adminon the gateway that's bound to the connection."

Once you get permissions run the below call

API End point - POST call

https://api.powerbi.com/v2.0/myorg/me/gatewayClusters/<GatewayClusterID>/datasources/<ConnectionDI>/users

Body 

{"identifier":"3d57a533-0719-4528-9d32-7f62c153acb8","datasourceAccessRight":"Read","emailAddress":null,"role":"User"

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!

[nguidoux]

I'm trying to add a ServicePrincipalProfile to a Databricks connection. The Service Principal I'm making the call with is an Owner on the connection.

[tharunkumarRTK]

@nguidoux 

As far as I know, this API works with on prem gateway connection only. It will work for Source Cloud Connections or SCC.
Not sure if there is any such API available to do so.