Forum Discussion

FabScone75's avatar
FabScone75
Helper I
1 month ago
Solved

Notification when user is added to workspace

Hello, 

 

I have a workspace which has very sensitive data in it. The workspace owner is concerned about users getting access to this workspace who should not see the data. As Fabric Admin, I have created the applicable roles and added the appropriate users, but there are a few others within the organisation who have admin rights and could in theory grant themselves or others access to the workspace, and this is making the workspace owner anxious. They want more control to see what's going on. 

 

I want to create a power automate process that checks the workspace on a regular basis (say every 30 minutes), and if a new user is added, it will notify the specified person(s).  However, I am struggling to get this to work. All steps pass except the last one which gets the activity events. 

 

My process gets the secret from the keyvault for a specific Service Principal. This service principal has the Power BI service Tenant.ReadWrite.All rights.  I have checked on the API permissions and they have ALL been granted to a security group which this service principal I use is a member of. 

 

The power automate flow then uses the above secret to get a new token, parses the token the extract the token code, generates a startDateTime and endDateTime variable and finally makes an HTTP call as follows:

{
  "type": "Http",
  "inputs": {
    "uri": "https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='@{variables('startDateTime')}'&endDateTime='@{variables('endDateTime')}'&$filter=Activity eq 'AddWorkspaceUser' and (WorkspaceId eq 'ABCDEF12-6297-4373-87A8-8978F7B7D518' or WorkspaceId eq 'DEFGHI12-51C9-4C21-ACEC-96881D219116' or WorkspaceId eq 'JKLMNOP12-C4AD-4A00-9C7A-731A66755632')",
    "method": "GET",
    "headers": {
      "Authorization": "Bearer @{body('Parse_JSON')?['access_token']}"
    }
  },
  "runAfter": {
    "Initialize_endDateTime_variable": [
      "Succeeded"
    ]
  },
  "runtimeConfiguration": {
    "contentTransfer": {
      "transferMode": "Chunked"
    }
  }
}
 
My questions are:

 

  1. Is this the right way to achieve my objective?
  2. If so, what am I doing wrong with my last step that is causing the error, Status code 401, PowerBINotAuthorizedException?

Thank you for your help. 

Need Help
  • FabScone75's avatar
    FabScone75
    1 month ago

    In case anyone else has a similar need, what I ended up doing was using a different endpoint and bringing back the Groups. 

     

    https://api.powerbi.com/v1.0/myorg/admin/groups?$filter=id eq 'ABCDEF-6297-4373-87a8-8978f7b7d518' or id eq 'JKLMNO-51c9-4c21-acec-96881d219116' or id eq 'KLMNOP-c4ad-4a00-9c7a-731a66755632'&$expand=users&$top=5000

     

    I also used a different Service Principal which resolved my authorisation issues. 

     

    I added steps to filter out the authorised users and an email to notify the workspace owners in the event that any unauthorised users were found. 

2 Replies

  • arvindsingh802's avatar
    arvindsingh802
    Community Champion
    1 month ago

    1. Yes based on logs you will get notified if anyone has been added to workspace
    2. As per microsoft doc - Admin - Get Activity Events - REST API (Power BI Power BI REST APIs) | Microsoft Learn, When running under service prinicipal authentication, an app must not have any admin-consent required premissions for Power BI set on it in the Azure portal
    So would suggest to remove Power BI service Tenant.ReadWrite.All rights
    b. In Power BI tenent settings - Allow service principals to use read-only Admin APIs for service groups your service principle is part of
    After making these 2 changes and try again.





  • FabScone75's avatar
    FabScone75
    Helper I
    1 month ago

    In case anyone else has a similar need, what I ended up doing was using a different endpoint and bringing back the Groups. 

     

    https://api.powerbi.com/v1.0/myorg/admin/groups?$filter=id eq 'ABCDEF-6297-4373-87a8-8978f7b7d518' or id eq 'JKLMNO-51c9-4c21-acec-96881d219116' or id eq 'KLMNOP-c4ad-4a00-9c7a-731a66755632'&$expand=users&$top=5000

     

    I also used a different Service Principal which resolved my authorisation issues. 

     

    I added steps to filter out the authorised users and an email to notify the workspace owners in the event that any unauthorised users were found.