Call Refresh user membership/permission API under service principal (PBI embedded for Org)

[EduardD]

Hi folks, 

I want to confirm that we can call RefreshUserMenership API under service principal.
Users - Refresh User Permissions - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Will it work for users with MFA? 

What permission service pricnipal should have to run that API? We are getting 401 when try to call that API using with service principal using user token.

[EduardD]

Thank you, we do have that. Any specific permissions required for it to call the refresh group membership api?

[aj1973]

To authenticate, the service principal uses the Microsoft Entra app's application ID and one of the following:

• A certificate
• An application secret

[aj1973]

Hi @EduardD 

Technically you need to use a Power BI App registration in order to call the API :

To authenticate, the service principal uses the Microsoft Entra app's application ID and one of the following:

• A certificate
• An application secret

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal

[EduardD]

Thank you, but we already know all that, the question is for that specific API listed above.
Can service principle call that API on user behalf?
what specific Power BI permission should be assigned to the service principal?  For example, should Service principal be a Power BI admin for calling that API?  

[aj1973]

No a user or UID can't use the API.

The service principal should have full access through Read.Write all in the APP registration.