Automate importing PowerBI audit logs using Application or Service Principle - Python MSAL

[Anonymous]

Hi Guys

I wanted to share information about the automation of importing PowerBI audit logs using Application Permissions from PowerBI service right from App registration to using MSAL python library.

Since most of the company's we use multifactor authentication, delegated permissions will not allow any python/.net application to get automated. 

Application Permissions

The first thing we need to perform is registering an app in Azure portal or using app registration using following link https://dev.powerbi.com/apps

App Registration:

Perform app registration steps only as mentioned in the following blog (https://carldesouza.com/how-to-register-an-azure-app-to-use-with-power-bi/) and DO NOT set any permissions. Since these permissions didn't work while authenticating the token generated.

Permissions:

1. After assigning Tenant.Read.All make sure you are Not accepting the admin consent as suggested by below documentation.

https://docs.microsoft.com/en-us/power-bi/admin/read-only-apis-service-principal-authentication

1. Create Client Secret and keep this handy.

Making API calls using MSAL library:

1. MSAL client secret example can be found here

https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/sample/confidential_...

1. Create json parameter file(Parameters.json) with following configurations and endpoints

{    "authority": "https://login.microsoftonline.com/Enter you tenantID Here ",

    "client_id": "Enter ClientID of the app you have Registered",

    "scope": ["https://analysis.windows.net/powerbi/api/.default"],

    "secret": "Enter Client Secret you created above",

    "endpoint": "https://api.powerbi.com/v1.0/myorg/admin/groups?$expand=datasets,dataflows,reports,dashboards,users&..."

}

1. Install necessary MSAL library for Python using "pip install msal" in your command prompt
2. You can get the code I have used to generate user activity data from git link. Even though I have mentioned an endpoint in the parameters file I am deriving my required user activity endpoint in the Python program since I have to generate several extracts with several endpoints and I want to use a single parameter file for all those extracts.

Note: There might be better ways to program in Python to extract the data from these API's but this is what I have developed which is working successfully.

[v-luwang-msft]

Hi  @Anonymous ,

Good idea. You can tag your own answers to the solution so that more people can see it and so you can help more people.

Best Regards

Lucien