Rest API getdatasetsingroupasadmin fails on some workspaces

[Anonymous]

Dear All,

We have been developing some PowerShell scripts to call the admin REST APIs using a service principal. We collect artifact information in the follwing way:

1. Call the admin workspakce api to get a list of workspaces

2. Loop through this list and call the relevant admin APIs to get reports, datasets, dashboards for each workspace. 

This was all working fine. However in the last few days the call to get the datasets has starting failing on some workspaces. The API we are using is the Admin - Datasets GetDatasetsInGroupAdAdmin https://docs.microsoft.com/en-us/rest/api/power-bi/admin/datasets-get-datasets-in-group-as-admin. The API call fails where the security group the service principal is in, has no permissions to the relevant worksapce. 

I was under the impression calls using the admin API's didn't need permissions set on each individual workspace. This also makes sense as a. it was working fine before and b. the other calls such as getting a list of reportsper workspace work fine.

Has anyone else come across this issue before?

Thanks a lot,

Alex

[Anonymous]

Thanks for your response.

Yes that is all done. As I mentioned it is being accessed through a service principle already. It is just the Datasets GetDatasetsInGroupAsAdmin that is erroring on some workspaces (where the service principal is not a member in the workspace). The other API calls such as GetWorkspacesAsAdmin, GetReportsInGroupAsAdmin are all working fine in the same PowerShell script. 

It feels like the error you would see if you were running the non admin API call and didn't have access to the workspace.

Thanks,

Alex

[v-janeyg-msft]

Hi, @Anonymous 

Can you provide a screenshot of the error?

Regarding the permissions of the workspace, the admin doesn't have the right to view the content that doesn't belong to his own workspace, so I am not sure that this is an issue when you use the API.

The request for each API call are also different, not the same.

Did I answer your question ? Please mark my reply as solution. Thank you very much.
If not, please feel free to ask me.

Best Regards,

Community Support Team _ Janey

[Anonymous]

The error gives a 401 unauthorised. However the error message said I am calling groups API, but I am actually calling admin/groups.

Response : Unauthorized (401):
{"error":{"code":"PowerBINotAuthorizedException","pbi.error":{"code":"PowerBINotAuthorizedException","parameters":{},"details":[],"exceptionCulprit":1}}}
PowerBIErrorInfo :
RequestId : <requestid>
ResponseDate : Thu, 23 Sep 2021 14:19:32 GMT
RequestMethod : GET
RequestUri : https://api.powerbi.com/v1.0/myorg/groups/<workspaceid>/datasets

This is the PowerShell call I am making which results in an error:

Invoke-PowerBIRestMethod -Url "admin/groups/<workspaceid>/datasets"

HOWEVER if I make the admin reports API call to the same workspace there is no issue. 

Invoke-PowerBIRestMethod -Url "admin/groups/<workspaceId>/reports" -Method Get | ConvertFrom-Json

[v-janeyg-msft]

Hi, @Anonymous 

Have you tried refreshing the browser cache?

Best Regards,

Community Support Team _ Janey

[v-janeyg-msft]

Hi, @Anonymous 

You can try to log in admin account and check this setting in admin portal >>admin api settings, and add security groups.

Reference:

Enable service principal authentication for read-only admin APIs - Power BI | Microsoft Docs

In addition: Are you the administrator?

Reference:

Admin - Groups GetGroupsAsAdmin - REST API (Power BI Power BI REST APIs) | Microsoft Docs

Did I answer your question ? Please mark my reply as solution. Thank you very much.
If not, please feel free to ask me.

Best Regards,

Community Support Team _ Janey