Forum Discussion

Anonymous

Not applicable

4 years ago

Solved

Power BI Rest API wont accept Application Token

I have multiple Admin API calls in my pbix that run just fine if I use my own or the ServiceAccount token generated using PowerShell. But as soon as I try to substitute in the Access Token I get ...

Need Help

Anonymous
4 years ago
Solution found thanks to SpartaBI !

1. Go to App registration -> New registration

2. Give your app a name and use the default settings

3. Create a secret, and make sure you copy the right value

4. Copy the ClientId & TenantId

No need to do anything else with the app config.

Just add "MyNewApp" to the AAD security group, wait for a couple of minutes, then try your code.

Then for running a Non-Admin API call, the App needs added into the Workspace Permissions you want to read from.

You do not need to add any delegated permissions to the app.
In order to allow a service principal access no non-admin APIs, it must have the same dataset/workspace permissions as any other user. For example- you can add the service principal as a member of a workspace.

This is exactly the purpose of the other setting in the Admin Portal.
It defines the service principals whose permissions are being managed by the Power BI Service itself.

SpartaBI

Community Champion

4 years ago

Hi Anonymous,

Your M code works fine- I've tried it.

Did you set the configurations in the Power BI Admin Portal to allow service principals access to the Power BI Service & usage of the admin APIs?

I'm not sure that you need the first option, but you definitely need the second one.
You should add the service principal (it has the same name as your app) to an AAD security group, then add the latter to both settings.

Anonymous

Not applicable

4 years ago

Yes, we do have everything setup like this, all of the Enabled ones are set for Only our Power BI Admin Security Group.

Are you saying you can search for and add the Registered Application into that Security Group? Maybe thats the catch here? I had played around with removing the Only part on these settings so it was Entire Organization to see if that made a difference and it didn't.

**Edit, I do see under AD there is a section about Applications when viewing my Security Group. I am not an Azure Admin so I'm checking with one to try and add it here.

SpartaBI
Community Champion
4 years ago
Hi Anonymous,

Yes. For example, in Azure I have an application

which is a member of a security group (the actual member is the service principal of the application)

In Power BI, the security group is set for both admin portal categories.

I can use "SP Power BI General" to run your script.
- Anonymous
  Not applicable
  4 years ago
  We tried this out. No luck. Created a Security Group, Service Principle account, added it into the Group, added the SP to Own the Application, and added the Group onto the Power BI Admin portal in those API settings.
  
  You said the M-code worked for you, just to confirm, was it both the GET Access Token and the API Call for Workspaces and Expanded info?
  
  Besides doing this, I'm really stuck now. What else makes sense to anyone?
  - SpartaBI
    Community Champion
    4 years ago
    Hi Anonymous,
    
    Both the GET Access Token and the API Call for Workspaces work for me.
    
    I'm not sure what you mean by "adding the SP to own the application".
    I suggest you'll create a new app. From your opening post, I gather you grant it permissions- which is redundant. To create an app do this:
    
    1. Go to App registration -> New registration
    2. Give your app a name and use the default settings
    
    3. Create a secret, and make sure you copy the right value
    
    4. Copy the ClientId & TenantId
    No need to do anything else with the app config.
    
    Just add "MyNewApp" to the AAD security group, wait for a couple of minutes, then try your code.