Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
4 years ago
Solved

Power BI Rest API wont accept Application Token

I have multiple Admin API calls in my pbix that run just fine if I use my own or the ServiceAccount token generated using PowerShell.   But as soon as I try to substitute in the Access Token I get ...
Need Help
  • Anonymous's avatar
    Anonymous
    4 years ago

    Solution found thanks to SpartaBI !

     

    1. Go to App registration -> New registration

     

    2. Give your app a name and use the default settings

     


    3. Create a secret, and make sure you copy the right value

     

     


    4. Copy the ClientId & TenantId

     

    No need to do anything else with the app config.

    Just add "MyNewApp" to the AAD security group, wait for a couple of minutes, then try your code.

     

    Then for running a Non-Admin API call, the App needs added into the Workspace Permissions you want to read from.

     

    You do not need to add any delegated permissions to the app.
    In order to allow a service principal access no non-admin APIs, it must have the same dataset/workspace permissions as any other user. For example- you can add the service principal as a member of a workspace.

     



    This is exactly the purpose of the other setting in the Admin Portal.
    It defines the service principals whose permissions are being managed by the Power BI Service itself.

     

     

Anonymous's avatar
Anonymous
Not applicable
4 years ago

Hi SpartaBI ,

 

Can you clear one thing up for me, how are you adding the App to an AAD security group?

SpartaBI's avatar
SpartaBI
Community Champion
4 years ago

Hi Anonymous,

You do not need to grant the Power BI Service API Permissions to the App.
Those permissions are used to allow user delegation (i.e., the app acts on behalf of a user account).
When you use "grant_type = client_credentials", you are using the permissions granted to the app's service principal.

Adding the app's service principal to the security group:

Go to your AAD


Find the security group




Choose "Add members"


Search for the service principal (same name as the app) and add it

 

 

 


Showcase Report – Contoso By SpartaBI


     

  • Anonymous's avatar
    Anonymous
    Not applicable
    4 years ago

    Hi SpartaBI 

     

    Thank you for your patience and help!

     

    We have 95% Success! We created a New App (with no API Permissions) and added both into the Security Group we created just for SP's.

     

    *I think my confusion was that a Service Principle exists for the App Registration, and I was thinking it had to somehow use a physically created Service Principle user we created.

     

    Our 1st App Registration that had the API Permissions, but was otherwise identical to the 2nd new App Reg, still wouldn't work after adding into the Security Group.

    But at least the 2nd App is working in the API.

     

    I said 95% because it works on all of my admin/ API calls, but it won't work on a non-Admin call. I have one trying to get the refresh schedules across the list of WorkspaceIDs and that says Access Forbidden. This same function structure works for another one that gets all Users off the Apps because thats an admin/ call.

     

    Thoughts??

    I'm thinking we need to now add in the API Permissions that the non-Admin calls get treated as Delegated and will need those added? I'm also hoping by adding those permissions, it wouldn't break whats working and cause us to have to recreate again (just saying this because I know how querky MS can be sometimes).

     

    *FYI, yes that previous post would be at least part of the solution to this posting, but I'm hoping we figure out how to get this non-Admin API working, then consolidate the answers into 1 post and mark that as the solution. This can hopefully help a lot of people.

     

    (datasetId as text) =>
    let
    Source = Json.Document(Web.Contents("https://api.powerbi.com/v1.0/myorg/",
    [
    RelativePath = "datasets/" & datasetId & "/refreshSchedule",
    Headers=[Authorization="Bearer " & #"GET Access Token"()]
    ] )),
    value = Source[value],
    #"Converted to Table" = Table.FromList(value, Splitter.SplitByNothing(), null, null, ExtraValues.Error)
    in
    #"Converted to Table"

     

     

  • Anonymous's avatar
    Anonymous
    Not applicable
    4 years ago

    Hi SpartaBI *update

     

    The strange thing here is that the Admin/ API calls worked, the datasets/ call would say Access Forbidden.

     

    We tried adding API Permissions to the App Registration and when doing all of the Read permissions that did not require Azure Admin Consent, nothing changed. Once we added any of the Tenant.ReadAll (Delegated or Application) and had the Azure Admin grant permissions, then the Admin/ API calls stopped working, but the datasets/ still didn't work either.

     

    I'm running out of ideas here. When reading the REST API documentation, it does says under the datasets/ that you just needed scope for Datasets.ReadAll or Datasets/ReadWriteAll so I'm not sure why it still refuses to work.

     

    I was even trying this call just to make sure it was not relying on any other calls in my PQ steps. It works with my PowerShell retrieved token.

     

    let
    Source = Json.Document(Web.Contents("https://api.powerbi.com/v1.0/myorg/",
    [
    RelativePath = "datasets/{datasetid}/refreshSchedule",
    Headers=[Authorization="Bearer " & #"GET Access Token"()]
    ] ))
    in
    Source