Forum Discussion
Helper INew-PowerBIReport is throwing BadRequest error with Connect-PowerBIServiceAccount Silent login
Yes, Anjan. I opened a ticket yesterday and have a call scheduled with Microsoft today to go over the issue. Thanks again to everyone for your help and support so far.
Helper IThank you Shahid12523 and johnbasha33 for your help. We already have our service principal configured in Power BI Admin with the setting 'Allow service principals to use Power BI APIs' enabled. It also has Admin role access to the relevant workspaces.
Our Java application has been working fine so far—it’s able to refresh datasets, retrieve report lists, and bind reports to different datasets. The app is also granted the Report.ReadWrite.All permission.
However, I’m currently running into issues with report upload, and I’m wondering if there are any additional settings or permissions that need to be enabled to allow this operation to succeed.
Thanks again for your support!
v-achippaCommunity Support
Hi skumar73,
Thank you for reaching out to Microsoft Fabric Community.
Thank you Shahid12523 and johnbasha33 for the prompt response.
Thank you for confirming your tenant setting and workspace role. Here the issue is because of a specific limitation that the service principals cannot import PBIX files that have a protected sensitivity label. With the interactive login(user token) the same pbix can publish, that is why your java app and listing calls work but the SP based upload fails with 400 BadRequest. Please follow below steps:
- Save the pbix without a protected label, like set the Sensitivity to None or an unprotected label, save it and then publish via the service principal. After import apply the sensitivity label in the service so the content is protected in the workspace even though the file itself was not encrypted at upload.
- If your policy requires protected labels on the pbix file itself, use a delegated user token for the import step and keep using the service principal for remaining things like refresh/rebind/list.
Please refer the below document, this is covered in Microsoft’s Import API documentation, for your reference:
https://learn.microsoft.com/en-us/rest/api/power-bi/imports/post-import
Thanks and regards,
Anjan Kumar Chippa
- skumar73
Thanks, Anjan, for pointing out the documentation I had overlooked and for the additional suggestions regarding sensitivity labels. That said, I won’t be able to use a user-delegated token, as I’m working on a CI/CD implementation with GitLab where interactive login isn’t an option.
Since there’s currently no official solution for GitLab, I’m building a custom approach using the Power BI REST API and PowerShell scripts. Thanks!
- v-achippa
Hi skumar73,
Thank you for the response, iam glad that the documentation helped clarify things. Yes, for CI/CD with GitLab, service principals are the right approach. At present because of the import limitation with protected PBIX files the only supported way is what you have outlined.
I recommend submitting this as a feature request with detailed feedback and ideas through Microsoft's official feedback channels. Feedback submitted through these channels is frequently reviewed by the product teams and can contribute to meaningful improvements.Fabric Ideas - Microsoft Fabric Community
Thanks and regards,
Anjan Kumar Chippa
- skumar73
09/05 Update
Had a call with Microsoft Support where I walked them through the issue. I demonstrated that the resource account is able to perform other admin-level operations—such as adding users and deleting reports from the workspace—without any issues.
After the call, I conducted additional testing and observed some strange behavior:
I created a report directly in the Power BI Service, using a calculated table.
I then downloaded that report and attempted to upload it through the same resource account.
Interestingly, the upload succeeded, but it created a new version of the report along with a new semantic model.
Subsequent uploads started overwriting that second version, not the original.
I’ve shared these findings with Microsoft. Based on this behavior, it appears the upload operation works—but not consistently or as expected when using a resource account. There's likely a bug or undocumented restriction affecting how uploads are handled in this context.
I will continue to research and post my updates here.