Forum Discussion
New-PowerBIReport is throwing BadRequest error with Connect-PowerBIServiceAccount Silent login
I'm running into an issue with my PowerShell script that uses the New-PowerBIReport cmdlet. When I authenticate using Connect-PowerBIServiceAccount with silent login, the script throws a BadRequest error during the report migration step.
Interestingly, the same script works fine using interactive login. Initially, I suspected that the user session might not be valid during the New-PowerBIReport call. However, I confirmed that silent login is working properly by calling another cmdlet (to list reports), which executed without any issues.
So it seems the issue is isolated to the New-PowerBIReport cmdlet when used with silent authentication.
Has anyone else run into this? If so, I’d appreciate any guidance or solutions you've come across.
Import-Module MicrosoftPowerBIMgmt
<#
#Getting GitLab PAT
$token = [System.Environment]::GetEnvironmentVariable("Gitlab_PAT", "User")
$outputPath = "$PSScriptRoot\Files\"
#Getting Env name & DB credentials
$aws_secret_id=[System.Environment]::GetEnvironmentVariable("PBI_ENV", "User")
$region = "us-west-2" # Change based on your secret's region
$response=Get-SECSecretValue -SecretId "$aws_secret_id" -Region $region
# Secrets can be stored as plaintext or JSON
$secretString = $response.SecretString
# If it's JSON, parse it
$secretObject = $null
if ($secretString.Trim().StartsWith('{')) {
$secretObject = $secretString | ConvertFrom-Json
}
$uid=($secretObject.'DB-UserName')
$pwd=($secretObject.'DB-Password')
$dburl=($secretObject.'DB-OracleUrl')
$sid=$dburl.Substring($dburl.IndexOf("/")+1)
$tenantId=($secretObject.'PowerBIEntra-Tenanat-ID')
$clientId=($secretObject.'PowerBIEntra-Client-ID')
$clientSecret=($secretObject.'PowerBIEntra-Client-Secret')
#Connect-PowerBIServiceAccount
$pwd = ConvertTo-SecureString $clientSecret -Force -AsPlainText
$credential = New-Object -TypeName System.Management.Automation.PSCredential($clientId,$pwd)
Connect-PowerBIServiceAccount -ServicePrincipal -TenantId "$tenantId" `
-Credential $credential
#>
Connect-PowerBIServiceAccount
$workspaceName = "Reporting Sandbox"
$workspace = Get-PowerBIWorkspace -Name $workspaceName
if($workspace)
{
Write-Host "The workspace named $workspaceName already exists."
}
else
{
Write-Host "Creating new workspace named $workspaceName..."
$workspace = New-PowerBIWorkspace -Name $workspaceName
}
$file = "C:\Users\Downloads\test.pbix"
New-PowerBIReport -Path $file -Workspace $workspace -ConflictAction CreateOrOverwrite
Disconnect-PowerBIServiceAccount
<#
This is migrating the report fine with interactive login
#>
Yes, Anjan. I opened a ticket yesterday and have a call scheduled with Microsoft today to go over the issue. Thanks again to everyone for your help and support so far.
13 Replies
New-PowerBIReport fails with service principal login because PBIX upload is blocked by default.
Fix:
In Power BI Admin Portal → Tenant settings, enable service principal for PBIX upload.
Ensure service principal has Admin/Member access to the workspace.
Without this, only interactive login works.
Hi
his usually isn’t a “session” problem—it’s permissions/tenant settings. With interactive login you (the user) have rights to publish; with silent login your service principal typically only has read/list rights, soNew-PowerBIReport (an upload) returns 400 BadRequest.-
Enable service principals for the tenant
Power BI Admin Portal → Tenant settings → Allow service principals to use Power BI APIs → Enabled and scoped to a security group that contains your app registration (service principal). Microsoft LearnMicrosoft Fabric Community+1 -
Put the service principal in the workspace with a write-capable role
Add it as Contributor/Member/Admin (Viewer/none won’t work even though listing reports can still succeed). You can do this with PowerShell (notePrincipalType App and the object id of the service principal):$ws = Get-PowerBIWorkspace -Name "Reporting Sandbox"
Add-PowerBIWorkspaceUser -Id $ws.Id `
-PrincipalType App `
-Identifier <SERVICE_PRINCIPAL_OBJECT_ID> `
-AccessRight ContributorDocs for the cmdlet are here. Microsoft Learn
(You can also do it in the workspace’s Access pane in the Service UI.)-
Use correct service principal auth in your script
Your silent block looks fine; this is the canonical pattern:
$sec = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($clientId, $sec)
Connect-PowerBIServiceAccount -ServicePrincipal -Tenant $tenantId -Credential $credDid I answer your question? Mark my post as a solution! Appreciate your Kudos !!
-
-
Thank you Shahid12523 and johnbasha33 for your help. We already have our service principal configured in Power BI Admin with the setting 'Allow service principals to use Power BI APIs' enabled. It also has Admin role access to the relevant workspaces.
Our Java application has been working fine so far—it’s able to refresh datasets, retrieve report lists, and bind reports to different datasets. The app is also granted the Report.ReadWrite.All permission.
However, I’m currently running into issues with report upload, and I’m wondering if there are any additional settings or permissions that need to be enabled to allow this operation to succeed.
Thanks again for your support!
Thank you Shahid12523 and johnbasha33 for your help. We already have our service principal configured in Power BI Admin with the setting 'Allow service principals to use Power BI APIs' enabled. It also has Admin role access to the relevant workspaces.
Our Java application has been working fine so far—it’s able to refresh datasets, retrieve report lists, and bind reports to different datasets. The app is also granted the Report.ReadWrite.All permission.
However, I’m currently running into issues with report upload, and I’m wondering if there are any additional settings or permissions that need to be enabled to allow this operation to succeed.
Thanks again for your support!
Hi skumar73,
Thank you for reaching out to Microsoft Fabric Community.
Thank you Shahid12523 and johnbasha33 for the prompt response.
Thank you for confirming your tenant setting and workspace role. Here the issue is because of a specific limitation that the service principals cannot import PBIX files that have a protected sensitivity label. With the interactive login(user token) the same pbix can publish, that is why your java app and listing calls work but the SP based upload fails with 400 BadRequest. Please follow below steps:
- Save the pbix without a protected label, like set the Sensitivity to None or an unprotected label, save it and then publish via the service principal. After import apply the sensitivity label in the service so the content is protected in the workspace even though the file itself was not encrypted at upload.
- If your policy requires protected labels on the pbix file itself, use a delegated user token for the import step and keep using the service principal for remaining things like refresh/rebind/list.
Please refer the below document, this is covered in Microsoft’s Import API documentation, for your reference:
https://learn.microsoft.com/en-us/rest/api/power-bi/imports/post-import
Thanks and regards,
Anjan Kumar Chippa
Thanks, Anjan, for pointing out the documentation I had overlooked and for the additional suggestions regarding sensitivity labels. That said, I won’t be able to use a user-delegated token, as I’m working on a CI/CD implementation with GitLab where interactive login isn’t an option.
Since there’s currently no official solution for GitLab, I’m building a custom approach using the Power BI REST API and PowerShell scripts. Thanks!
Since service principals aren’t supported for uploading/migrating reports into Power BI workspaces, I tried using a domain resource account—a user like account without MFA for systematic process.
Everything else works as expected:
Credentials are read successfully from AWS Secrets Manager
Reports are downloaded from GitLab
Workspace connection is established
Other operations like adding users and deleting reports from the workspace are working fine
However, the upload/migrate report step fails with an “Unauthorized” error.
I haven’t found any documentation suggesting that domain resource accounts are unsupported by this cmdlet. So, I’m planning to open a ticket for this issue unless there’s a known limitation I might be missing.
Let me know if anyone has run into something similar or has guidance before I proceed.
Hi skumar73,
Thank you for the response and confirming that it is working as expected, except the upload/migrate report step. I suggest you to please raise a support ticket for further assistance. To raise a support ticket, kindly follow the steps outlined in the following guide:
How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn
Thanks and regards,
Anjan Kumar Chippa
Yes, Anjan. I opened a ticket yesterday and have a call scheduled with Microsoft today to go over the issue. Thanks again to everyone for your help and support so far.
