Forum Discussion
Configuring EffectiveIdentity for "Export To File In Group" API
Alright, I've finally found out what's wrong, and I'm not sure if I want to be relieved or frustrated at the fix. It appears that had a typo in my request body. In the code above the effective identity was passed as a property with name "identity" when it should have been "identities" instead.
Hi rvp_ordix ,
Thank you for reaching out to the Microsoft fabric community forum. Also thank you Akash_Varuna for your inputs.
You've already validated key items great work so far. To help move this forward, here are some important points to consider:
- The username used in EffectiveIdentity must match exactly what USERPRINCIPALNAME() returns in the report. Based on your notes, this seems correct.
- Ensure the dataset is in Import or DirectQuery mode. RLS with EffectiveIdentity does not work for Live connection datasets (like those using a shared semantic model or AS live connections).
- Fabric Trial capacity does support EffectiveIdentity, but in practice, certain advanced operations especially RLS-based exports can behave inconsistently under trial limits. If possible, test in a dedicated Fabric or Premium capacity workspace to validate.
- Make sure the user is assigned to the RLS role in the dataset and has at least Viewer access in the workspace.
You can refer to this Microsoft documentations for further reference on using EffectiveIdentity with export APIs:
Reports - Export To File - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Embed Token - Tiles GenerateTokenInGroup - REST API (Power BI Power BI REST APIs) | Microsoft Learn
I hope this will resolve your issue, if you need any further assistance, feel free to reach out.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thankyou.
I had most of these points already checked before and using a full Capacity instead of the trial didn't change anything, sadly. After some experimenting, though, I've narrowed down the error. My failed request attempts so far where done via Postman, and it immediately worked when I tried to send the request via the API's Microsoft Learn page instead. That tells me, that the problem was probably with the Bearer Token I used for authentication.
The Bearer Token request is a separate step and authenticates itself with client_credentials to an App I registered in Azure with resource being set as https://analysis.windows.net/powerbi/api. This App has the necessary Read.All-permissions on Report and Dataset as well as user_impersonation and Users.Read (all of them as Delegated Permissions), but I have not otherwise touched role/permission-assignments there. The app is also added to the workspace as Administrator, and to the RLS role.
Are there additional steps required that need to be configured?