Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
4 years ago
Solved

Power BI Rest API wont accept Application Token

I have multiple Admin API calls in my pbix that run just fine if I use my own or the ServiceAccount token generated using PowerShell.   But as soon as I try to substitute in the Access Token I get ...
Need Help
  • Anonymous's avatar
    Anonymous
    4 years ago

    Solution found thanks to SpartaBI !

     

    1. Go to App registration -> New registration

     

    2. Give your app a name and use the default settings

     


    3. Create a secret, and make sure you copy the right value

     

     


    4. Copy the ClientId & TenantId

     

    No need to do anything else with the app config.

    Just add "MyNewApp" to the AAD security group, wait for a couple of minutes, then try your code.

     

    Then for running a Non-Admin API call, the App needs added into the Workspace Permissions you want to read from.

     

    You do not need to add any delegated permissions to the app.
    In order to allow a service principal access no non-admin APIs, it must have the same dataset/workspace permissions as any other user. For example- you can add the service principal as a member of a workspace.

     



    This is exactly the purpose of the other setting in the Admin Portal.
    It defines the service principals whose permissions are being managed by the Power BI Service itself.

     

     

SpartaBI's avatar
SpartaBI
Community Champion
4 years ago

Hi Anonymous,

I'm not sure why adding the Tenant.ReadAll had any effect on the admin APIs- It shouldn't have.

You do not need to add any delegated permissions to the app.
In order to allow a service principal access no non-admin APIs, it must have the same dataset/workspace permissions as any other user. For example- you can add the service principal as a member of a workspace.



This is exactly the purpose of the other setting in the Admin Portal.
It defines the service principals whose permissions are being managed by the Power BI Service itself.



If you need to add the service principal programmatically to workspaces, you'll need to use
Add Group User API
or Add User As Admin API

The first API can be authorized by any user or service principal which has the right level of permissions on the workspace (I imagine you do not have an existing service principal to use here...). The second API is not a read-only admin API, so you'll have to use an admin user.

 

Showcase Report – Contoso By SpartaBI


     

Anonymous's avatar
Anonymous
Not applicable
4 years ago

Thanks again for your help SpartaBI.

 

I guess the flaw was me using that API call for a dataset refresh schedule that is apparently meant for a My Workspace, but the strange thing is it still worked on a Shared Workspace when I used my PowerShell generated Token.

 

This is what I was trying to use

 

 

This one just worked with the App Token with a groupid and datasetid for a test.

 

I was already trying the workspace permissions thing, but was using the Security Group that had the App's SP account in it. That apparently does not work. Once I added the App itself directly into the workspace permissions, now the GroupId/DatasetId API call works for me.

 

I'll post another reply combining your solutions to mark that 1 response as the solution. Thank you again!