Forum Discussion

DavidS524's avatar
DavidS524
Helper I
3 years ago

REST API Admin - Groups AddUserAsAdmin:"Parameter PrincipalType or Identifier is missing or invalid"

Hi everyone,

 

I am trying to use the REST API to add a mail-enabled security group as an admin on a workspace. I get the following error when using this format:

 

{
groupUserAccessRight: "Admin",
identifier: "[objectID of the group]",
principalType: "Group"
}

 

Result: 

{
  "error": {
    "code": "InvalidRequest",
    "message": "Parameter PrincipalType or Identifier is missing or invalid"
  }
}

 

I've tried every variation I can think of, including using the email address and displayname of the group as the identifier, or as separate parameters. In contrast, adding one of my colleagues as a user with their email address works just fine:

 

{
groupUserAccessRight: "Admin",
identifier: "[email address]",
principalType: "User"
}

 

For more context, I have also used the "Datasets - Post Dataset User In Group" API call to successfully grant a mail-enabled security group access on a dataset using the objectID:

 

{
datasetUserAccessRight: "ReadExplore",
identifier: "[objectID of the group]",
principalType: "Group"
}

 

This results in a successful Response Code 200 and the group is granted permissions.

 

After Googling around, I saw some posts from a few years ago with similar errors where the suggestion was to make sure the workspace was the newer version. The workspace I am trying to add this to was just created this week so that is not the issue. 

 

Any other ideas?

 

Thank you!

 

Need Help

5 Replies

  • tumuju's avatar
    tumuju
    Frequent Visitor
    3 years ago

    I am experiencing the same issue. Trying to add a security group to workspace as Admin results in the error: 'message': 'Parameter PrincipalType or Identifier is missing or invalid'.

    If replace the security group with an ordinary user, it works well. 

    • tumuju's avatar
      tumuju
      Frequent Visitor
      3 years ago

      I am a TENANT admin and I am trying to add a group to all workspaces. Specifically, I want to use this:  https://learn.microsoft.com/en-us/rest/api/power-bi/admin/groups-add-user-as-admin

       

      I have used the API to add my user id but I am not able to use on a group. It seems the API doesn't work when you use a group. 

      Here is my code

      $jsonRequestBody=@{
        identifier            = "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"
        principalType         = "Group"
        groupUserAccessRight  = "Admin"
      }|ConvertTo-Json

       

      Connect-PowerBIServiceAccount

      $workspaceId= "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"
      Write-Output "https://api.powerbi.com/v1.0/myorg/admin/groups/{$workspaceId}/users"
      #Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/myorg/groups/{$workspaceId}/users" -Method Post -Headers $authHeader  -Body $jsonRequestBody -Verbose
      $request=Invoke-PowerBIRestMethod -Url " https://api.powerbi.com/v1.0/myorg/admin/groups/$workspaceId/users" -Method Post -Verbose -Body $jsonRequestBody

      Invoke-PowerBIRestMethod : One or more errors occurred.
      At line:13 char:10
      + $request=Invoke-PowerBIRestMethod -Url "https://api.powerbi.com/v1.0/ ...
      +          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          + CategoryInfo          : WriteError: (Microsoft.Power...werBIRestMethod:InvokePowerBIRestMethod) [Invoke-PowerBIRestMethod], AggregateException
          + FullyQualifiedErrorId : One or more errors occurred.,Microsoft.PowerBI.Commands.Profile.InvokePowerBIRestMethod

      There response is 
      VERBOSE: Request Uri: https://api.powerbi.com/v1.0/myorg/admin/groups/xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx/users
      VERBOSE: Status Code: BadRequest (400)
      Invoke-PowerBIRestMethod : Encountered errors when invoking the command: {
        "code": "InvalidRequest",
        "message": "Parameter PrincipalType or Identifier is missing or invalid"

       

       

      The same code works well when I modifiy the body to
      $jsonRequestBody=@{
        emailAddress            = "[email protected]"
        principalType         = "User"
        groupUserAccessRight  = "Admin"
      }|ConvertTo-Json

      • aj1973's avatar
        aj1973
        Community Champion
        3 years ago

        The Identifier, where do you get it from? it can't be the name of the security group