Forum Discussion
New-PowerBIReport is throwing BadRequest error with Connect-PowerBIServiceAccount Silent login
Yes, Anjan. I opened a ticket yesterday and have a call scheduled with Microsoft today to go over the issue. Thanks again to everyone for your help and support so far.
Hi skumar73,
Thank you for reaching out to Microsoft Fabric Community.
Thank you Shahid12523 and johnbasha33 for the prompt response.
Thank you for confirming your tenant setting and workspace role. Here the issue is because of a specific limitation that the service principals cannot import PBIX files that have a protected sensitivity label. With the interactive login(user token) the same pbix can publish, that is why your java app and listing calls work but the SP based upload fails with 400 BadRequest. Please follow below steps:
- Save the pbix without a protected label, like set the Sensitivity to None or an unprotected label, save it and then publish via the service principal. After import apply the sensitivity label in the service so the content is protected in the workspace even though the file itself was not encrypted at upload.
- If your policy requires protected labels on the pbix file itself, use a delegated user token for the import step and keep using the service principal for remaining things like refresh/rebind/list.
Please refer the below document, this is covered in Microsoft’s Import API documentation, for your reference:
https://learn.microsoft.com/en-us/rest/api/power-bi/imports/post-import
Thanks and regards,
Anjan Kumar Chippa
09/05 Update
Had a call with Microsoft Support where I walked them through the issue. I demonstrated that the resource account is able to perform other admin-level operations—such as adding users and deleting reports from the workspace—without any issues.
After the call, I conducted additional testing and observed some strange behavior:
I created a report directly in the Power BI Service, using a calculated table.
I then downloaded that report and attempted to upload it through the same resource account.
Interestingly, the upload succeeded, but it created a new version of the report along with a new semantic model.
Subsequent uploads started overwriting that second version, not the original.
I’ve shared these findings with Microsoft. Based on this behavior, it appears the upload operation works—but not consistently or as expected when using a resource account. There's likely a bug or undocumented restriction affecting how uploads are handled in this context.
I will continue to research and post my updates here.