Supplies are limited. Contact info@espc.tech right away to save your spot before the conference sells out.
Get your discountScore big with last-minute savings on the final tickets to FabCon Vienna. Secure your discount
Hi !
I am trying to automate a PowerBI task using a service principal.
With a powershell script i want to add a group to all the workspaces in my organization.
I am using :
Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -Tenant $tenant
To connect with my service principal which works.
And then i want to retrieve all my workspaces by using :
Get-PowerBIWorkspace -All -Scope Organization -Type Workspace -Include All
But it doesn't work....
Error :
Failed to connect or retrieve workspaces: Operation returned an invalid status code 'Unauthorized'
It works if i don't put the -Scope Organization but in my case i want ALL the workspaces...
I made sure that the group and service principal got all the permissions in powerbi tenant or api settings as well.
They are literally Admin of the organization...
So if anyone know how to do it or want to help, feel free to talk !
Thanks.
Hi @Anonymous
Just to confirm you also have added the permissions in the Power BI Admin Portal Tenant settings?
Hi @GilbertQ,
Yes i have added my security group that contains my service principal into this setting and also added all API permissions to the service principal app (only delegated ones)...
Can it maybe be that the functionnality to retrieve all the workspaces as a service principal with the API is impossible right now ? I mean we can retrieve all the workspaces he is in but not as an admin even if he got the privileges ?
Thanks,
Best regards,
Quentin Michelix.
Hi @Anonymous
This is certainly possible as I do this every day for some of my clients.
Hi @GilbertQ ,
Do you mean that it is possible to retrieve all the workspaces in the organization with a service principal ? Or that there are limitations with the APIs when it's a service principal ?
Hi @GilbertQ !
Thanks for helping, so i tried and it returns me this error :
Line |
29 | … sResponse = Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1 …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Encountered errors when invoking the command: { "code": "PowerBINotAuthorizedException", "pbi.error": {
| "code": "PowerBINotAuthorizedException", "parameters": {}, "details": [], "exceptionCulprit": 1 } }
But i don't know why "PowerBINotAuthorizedException". The security group and the service principal got all the access to PowerBI and permissions in azure/microsoft 365...
Here's my code :
# Authenticate with Service Principal
try {
$secureSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $secureSecret)
Connect-PowerBIServiceAccount
Write-Host "Connected to Power BI Service Account successfully" -ForegroundColor Green
} catch {
Write-Host "Failed to connect to Power BI Service Account: $_" -ForegroundColor Red
exit
}
# Use the Admin API to retrieve all workspaces
try {
$url = "https://api.powerbi.com/v1.0/myorg/admin/groups?\$top=5000"
$workspacesResponse = Invoke-PowerBIRestMethod -Url $url -Method GET
$workspaces = $workspacesResponse.value
Write-Host "Retrieved workspaces successfully" -ForegroundColor Green
$workspaces | Format-Table Id, Name
} catch {
Write-Host "Failed to connect or retrieve workspaces: $_" -ForegroundColor Red
Write-Host "Detail: $_.Exception.Message" -ForegroundColor Red
Disconnect-PowerBIServiceAccount
exit
}
Write-Host "=================================================================================================================================="
Write-Host "Found a total of $($workspaces.Count) workspaces..."
Write-Host "=================================================================================================================================="
So it doesn't happen if i don't put the admin in the url but it will retrieve me only workspaces where the group is (not what i want)..
and with a token :
# Authenticate with Service Principal
try {
$secureSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $secureSecret)
Connect-PowerBIServiceAccount -ServicePrincipal -Credential $credential -TenantId $tenant
Write-Host "Connected to Power BI Service Account successfully" -ForegroundColor Green
} catch {
Write-Host "Failed to connect to Power BI Service Account: $_" -ForegroundColor Red
exit
}
# Obtain access token using client credentials flow for Power BI API
$body = @{
grant_type = "client_credentials"
client_id = $clientId
client_secret = $clientSecret
scope = "https://analysis.windows.net/powerbi/api/.default"
}
try {
$tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenant/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body
$accessToken = $tokenResponse.access_token
Write-Host "Obtained access token successfully" -ForegroundColor Green
} catch {
Write-Host "Failed to obtain access token: $_" -ForegroundColor Red
exit
}
$headers = @{
Authorization = "Bearer $accessToken"
}
# Retrieve all workspaces using Admin API
try {
$url = "https://api.powerbi.com/v1.0/myorg/groups?\$top=5000"
$workspacesResponse = Invoke-RestMethod -Uri $url -Headers $headers -Method Get
$workspaces = $workspacesResponse.value
Write-Host "Retrieved workspaces successfully" -ForegroundColor Green
$workspaces | Format-Table Id, Name
} catch {
Write-Host "Failed to connect or retrieve workspaces: $_" -ForegroundColor Red
Write-Host "Detail: $_.Exception.Message" -ForegroundColor Red
Disconnect-PowerBIServiceAccount
exit
}
Write-Host "=================================================================================================================================="
Write-Host "Found a total of $($workspaces.Count) workspaces..."
Write-Host "=================================================================================================================================="
Thanks..
Best Regards,
Quentin Michelix.
Hi @Anonymous
What if you rather use the REST API in PowerShell and use this REST API
Admin - Groups GetGroupsAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Learn
After authenticating try
Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/admin/groups?$top=5000" -Method GET