Microsoft 365 Usage Analytics refresh dataset with Service Principal

[Alex_Roughag]

I added "Microsoft 365 Usage Analytics" as a workspace using admin privileges. However, I want to automate refresh with the Service Principal. So I created a script, a service principal (which I assigned as a contributor to the workspace), but it seems the dataset is not refreshing if I'm not signed it.
When I check the Refresh history I see:

"The credentials provided for the OData source are invalid. (Source at https://reports.office.com/pbi/v1.0/<tenantID>/TenantOfficeActivation.). The exception was raised by the IDataReader interface. Please review the error message and provider documentation for further information and corrective action. Table: TenantOfficeActivation"

I assume this might be related to credentials, which require OAuth2 (and my account to be signed in). Because, When I read a documentation it says: "On the next screen, select OAuth2 as the Authentication method > Sign in. If you choose any other authentication method, the connection to the template app will fail".

I tried to add the service principal Data Connection, but I'm not able to manage (add/remove) Current Connection Users and it shows only me.

Is there a way I can automate Dataset Refresh with Service Principal (or with anything) without my admin account signed-in?

[Anonymous]

Hi @Alex_Roughag ,

Here are the steps you can take to troubleshoot and potentially resolve the issue:
1. Check Permissions: Verify that the Service Principal has been assigned the necessary permissions for accessing the data source. It should have at least the Contributor role on the workspace.

2. OAuth2 Authentication: As the documentation suggests, OAuth2 is required for authentication. Ensure that the Service Principal is configured for OAuth2 authentication. You may need to grant it admin consent in Azure AD for the necessary permissions.

3. Refresh Token: Service Principals do not inherently handle interactive sign-ins, so you'll need to use a refresh token or other non-interactive authentication methods meant for service-to-service calls.

Best regards,
Community Support Team_Binbin Yu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Alex_Roughag]

Hi @Anonymous 

Thank you for replying back.

1. Yes. The service principal has a Contributor role on the workspace.

2. As per the powershell script below, an access token is obtained using oAuth2.

3. I'm using the following powershell script to refresh the dataset. Not sure if it's possible to change auth to refresh token. Maybe you can advise?

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$clientid = "<clientID>" 
$NameSecret = "<secretName>"
$scope = "https://analysis.windows.net/powerbi/api/.default"
$tenantid = "<tenantID>"
$groupID = “<groupID>”
$dataset = “<datasetID>"

$myCredential = Get-AutomationPSCredential -Name $NameSecret
$clientsecret = $myCredential.GetNetworkCredential().Password

# Getting Access Token
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/x-www-form-urlencoded")
$body = "client_id=$clientid&client_secret=$clientsecret&scope=$scope&grant_type=client_credentials"

$response = Invoke-RestMethod "https://login.microsoftonline.com/$tenantid/oauth2/v2.0/token" -Method 'POST' -Headers  $headers -Body $body

$token = $response.access_token
$token = "Bearer $token"

# Refresh the Data Set
$authHeader = @{
    'Content-Type'='application/json'
     'Authorization'= $token
    }
$groupsPath = ""
if ($groupID -eq "me") {
    $groupsPath = "myorg"
   } else {
      $groupsPath = "myorg/groups/$groupID"
}
$uri = "https://api.powerbi.com/v1.0/$groupsPath/datasets/$dataset/refreshes"
Invoke-RestMethod -Uri $uri –Headers $authHeader –Method POST

$statusURL = "https://api.powerbi.com/v1.0/$groupsPath/datasets/$dataset/refreshes"
$response = Invoke-RestMethod $statusURL -Method 'GET' -Headers $authHeader
$status = $response.value[0].status

[lbendlin]

Have you considered using Login-PowerBIServiceAccount or AAD/Entra auth?