How to Schedule and Export PDF Reports with Dynamic Parameters for Multiple Sentinel Workspace IDs

[noob456]

Hi everyone, I'm trying to automate the creation and export of PDF reports from Power BI using parameters to target multiple Microsoft Sentinel workspaces, each from a different tenant. The idea is to run this on a monthly schedule, dynamically feed each Workspace ID as a parameter, and generate a PDF report for each. So far, I've tried using the Power BI REST API inside a Logic App, authenticated through an Azure AD App. While I can authenticate, the issue begins when trying to inject a parameter (Workspace ID) into the report. I've run into various errors, including 401 and 403, depending on the tenant and how authentication is handled. I’m not tied to any specific method, Logic Apps, Azure Functions, service principals, etc, as long as the result is automated, secure, and scalable across 40+ Microsoft Sentinel Workspaces. Has anyone achieved something similar or can share a working approach? Any guidance, working examples, or insights would be massively appreciated. Thanks in advance! 

[v-echaithra]

Hi @noob456 ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-echaithra]

Hi @noob456 ,

We’d like to follow up regarding the recent concern. Kindly confirm whether the issue has been resolved, or if further assistance is still required. We are available to support you and are committed to helping you reach a resolution.

Thank you for your patience and look forward to hearing from you.

Best Regards,
Chaithra E.

[v-echaithra]

Hi @noob456 ,

We would like to confirm if you've successfully resolved this issue or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are more than happy to continue to help you.

Thank you for your patience and look forward to hearing from you.

Best Regards,
Chaithra E.

[v-echaithra]

Hi @noob456 ,

Thank you for reaching out to Microsoft Community.

You can try this approach to generate standardized PDF reports from Power BI that reflect data from Microsoft Sentinel workspaces hosted in different Azure Active Directory (AAD) tenants.

Step 1: Design Parameterized Power BI Report

Begin by designing a Power BI report that accepts input parameters such as Workspace ID, Tenant Name, or other identifiers used to distinguish Sentinel data sources. This can be done using Power BI Query Parameters or Power Query M parameters. Within the report’s queries, use conditional logic to connect to the appropriate Microsoft Sentinel workspace based on the parameter values.
Once the report is fully functional and tested, publish it to the Power BI Service either to a single central tenant or separately to each tenant where Sentinel data resides, depending on your architecture and permission model.

Step 2: Set Up Multi-Tenant Authentication

To programmatically access Sentinel data and perform actions like report export or dataset refresh, you'll need to authenticate across multiple Azure AD tenants. The recommended approach is to register a Service Principal (App Registration) in each tenant:

Assign required API permissions to access Microsoft Sentinel data via Azure Monitor or Log Analytics API.
Grant Power BI service permissions (such as Dataset.Read.All, Report.Read.All, and Workspace.Read.All).
Use client credentials flow (OAuth 2.0) to acquire tokens scoped to each tenant.
Store tenant-specific credentials securely using Azure Key Vault or environment variables, especially when automating from Azure Functions or other services.

Step 3: Automate Dataset Refresh

If the Power BI report relies on live Sentinel data, you should initiate a dataset refresh before exporting the report to ensure accuracy.

Use the Power BI REST API's dataset refresh endpoint:

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/refreshes

For each tenant and associated workspace, issue a refresh request. Optionally, include logic to wait for the refresh to complete or poll for status before continuing to the export phase.

Step 4: Export Power BI Report to PDF with Parameters

Once the dataset is refreshed or if a refresh is not needed, use the Power BI Export API to generate a PDF report.
In the request body, include parameter values or filters to tailor the report output to a specific Microsoft Sentinel workspace. This ensures each report reflects only the data relevant to its intended tenant or workspace.

Step 5: Implement Automation Script or Azure Function
Develop an automation script or serverless function (using PowerShell, Python, or C#) that orchestrates the workflow:

Maintain a list of tenants and their corresponding Sentinel workspace IDs.
Authenticate to each tenant using the registered Service Principal and retrieve access tokens. For each tenant:

Refresh the dataset.
Trigger the PDF export with the correct parameter values.
Save the exported PDF to a central repository (e.g., Azure Blob Storage).
This script should be robust enough to handle token expiration, retry on failure, and logging for auditing purposes.

Step 6: Schedule and Monitor Automation

To run this process regularly e.g., daily or weekly:

Deploy the automation to Azure Functions with a Timer trigger.
Alternatively, use Azure Logic Apps to design a no-code workflow that runs on a schedule and calls your export function/script.
Azure Automation Runbooks can also be used if your organization prefers a more script-centric model with native integration into Azure Monitor and Key Vault.
Add monitoring and alerting (e.g., via Application Insights or email alerts) to capture any failed report exports or authentication issues.

Hope this helps.
Warm regards,
Chaithra E.

[noob456]

Thank you very much!! I think we thought the same as I'm already on the step 3, however everytime I attempt to refresh in PowerBI I get a message that I need to reauthenticate, I reauthenticate with the service principal data (tenant id, secret, etc..), I run the logic app again and same thing, this are the steps I doing 

1. Recurrence every hour

2. Initialize variables (workspace ID)

3. get Token

4. Dataset TakeOver 

5. Update Parameters

Everything works greate up to this point, but then when I attempt to refresh I get the error "It looks like scheduled refresh failed because at least one data source is missing credentials. To start the refresh again, go to this dataset's settings page and enter credentials for all data sources.", no matter what I do, I can re-authenticate manually and refresh manually, it works fine, if I use the logic app, it failed every time.... any thoughts?

[v-echaithra · Accepted solution]

Hi @noob456 ,

Although the Logic App works correctly at the API level, the Power BI Service is rejecting the dataset refresh due to missing or unsupported credentials for the underlying data source. Since you've already registered a service principal in each tenant, it’s important to ensure that it has the required API permissions, including Dataset.ReadWrite.All, Report.Read.All, and Workspace.Read.All. Additionally, your service principal must have direct access to the data source (for example, SQL or Log Analytics), and the data source itself must be capable of accepting service principal tokens.

Make sure admin consent has been granted for the permissions in each Azure Active Directory (AAD) tenant. The service principal should also be added to the appropriate Power BI workspace as either an Admin or Member. Furthermore, confirm that the Power BI tenant setting “Allow service principals to use Power BI APIs” is enabled. This setting can be found in the Power BI Admin Portal under Tenant settings > Developer settings.

It’s also essential to verify that your dataset supports authentication via service principal. To do this, navigate to Power BI Service > Dataset > Settings > Data Source Credentials and check if the data source supports service principal authentication. For instance, services like Azure SQL Database or Azure Data Lake support OAuth2 and can work with service principals, but they must be configured explicitly for this type of authentication.

Finally, ensure that the setting under Datasets in the Power BI Admin Portal “Allow XMLA endpoint and Analyze in Excel with on-premises datasets” – is not configured in a way that blocks service principal access.

Hope this helps,
Best Regards,
Chaithra E.