Forum Discussion
Microsoft 365 Usage Analytics refresh dataset with Service Principal
Hi Alex_Roughag ,
Here are the steps you can take to troubleshoot and potentially resolve the issue:
1. Check Permissions: Verify that the Service Principal has been assigned the necessary permissions for accessing the data source. It should have at least the Contributor role on the workspace.
2. OAuth2 Authentication: As the documentation suggests, OAuth2 is required for authentication. Ensure that the Service Principal is configured for OAuth2 authentication. You may need to grant it admin consent in Azure AD for the necessary permissions.
3. Refresh Token: Service Principals do not inherently handle interactive sign-ins, so you'll need to use a refresh token or other non-interactive authentication methods meant for service-to-service calls.
Best regards,
Community Support Team_Binbin Yu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Hi Anonymous
Thank you for replying back.
1. Yes. The service principal has a Contributor role on the workspace.
2. As per the powershell script below, an access token is obtained using oAuth2.
3. I'm using the following powershell script to refresh the dataset. Not sure if it's possible to change auth to refresh token. Maybe you can advise?
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$clientid = "<clientID>"
$NameSecret = "<secretName>"
$scope = "https://analysis.windows.net/powerbi/api/.default"
$tenantid = "<tenantID>"
$groupID = “<groupID>”
$dataset = “<datasetID>"
$myCredential = Get-AutomationPSCredential -Name $NameSecret
$clientsecret = $myCredential.GetNetworkCredential().Password
# Getting Access Token
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/x-www-form-urlencoded")
$body = "client_id=$clientid&client_secret=$clientsecret&scope=$scope&grant_type=client_credentials"
$response = Invoke-RestMethod "https://login.microsoftonline.com/$tenantid/oauth2/v2.0/token" -Method 'POST' -Headers $headers -Body $body
$token = $response.access_token
$token = "Bearer $token"
# Refresh the Data Set
$authHeader = @{
'Content-Type'='application/json'
'Authorization'= $token
}
$groupsPath = ""
if ($groupID -eq "me") {
$groupsPath = "myorg"
} else {
$groupsPath = "myorg/groups/$groupID"
}
$uri = "https://api.powerbi.com/v1.0/$groupsPath/datasets/$dataset/refreshes"
Invoke-RestMethod -Uri $uri –Headers $authHeader –Method POST
$statusURL = "https://api.powerbi.com/v1.0/$groupsPath/datasets/$dataset/refreshes"
$response = Invoke-RestMethod $statusURL -Method 'GET' -Headers $authHeader
$status = $response.value[0].status
Have you considered using Login-PowerBIServiceAccount or AAD/Entra auth?
