Forum Discussion
Service Principal returning 401/PowerBINotAuthorizedException after client secret renewal
I have a service principal (Azure App Registration) that was previously working with Power BI Admin APIs. After the original client secret expired, I created a new secret in the same app registration. Now all admin API calls (e.g., https://api.powerbi.com/v1.0/myorg/admin/groups) return 401 with PowerBINotAuthorizedException. I've verified the following: (1) Token is successfully acquired and decoded at jwt.ms shows correct audience (https://analysis.windows.net/powerbi/api), app ID, and roles (Tenant.Read.All, Tenant.ReadWrite.All); (2) API permissions in Azure Portal show both Tenant.Read.All and Tenant.ReadWrite.All as Application permissions with admin consent granted; (3) The service principal is a member of a Security-type group (confirmed member type is "Service principal"); (4) Power BI Admin Portal has "Service principals can access read-only admin APIs" and "Service principals can access admin APIs used for updates" enabled for this security group. I've tried: re-granting admin consent, removing and re-adding the security group in Power BI settings, creating a new security group, and waiting 30+ minutes for propagation. Interestingly, delegated (user) authentication with the same app works fine for admin APIs—only service principal authentication fails. RequestId from error: d642e6be-3f00-4131-b8e0-1a9ca8c6c404.
Any guidance would be appreciated.
Hii harshacollate
This usually happens because, after renewing the client secret, the service principal token is valid but Power BI does not recognize it as authorized for Admin APIs. Even though the JWT shows correct roles, Power BI Admin APIs require that the service principal is explicitly allowed in the Power BI Admin Portal and that Application permissions (Tenant.Read.All / Tenant.ReadWrite.All) are used with a client-credentials token. Re-check that the token is requested for the correct resource (https://analysis.windows.net/powerbi/api), the app is still a member of the allowed security group, and the tenant setting “Allow service principals to use Power BI APIs” (and Admin APIs) is enabled. A full secret rotation sometimes also requires waiting for backend propagation or restarting the calling service.
3 Replies
rohit1991Super User
Hii harshacollate
This usually happens because, after renewing the client secret, the service principal token is valid but Power BI does not recognize it as authorized for Admin APIs. Even though the JWT shows correct roles, Power BI Admin APIs require that the service principal is explicitly allowed in the Power BI Admin Portal and that Application permissions (Tenant.Read.All / Tenant.ReadWrite.All) are used with a client-credentials token. Re-check that the token is requested for the correct resource (https://analysis.windows.net/powerbi/api), the app is still a member of the allowed security group, and the tenant setting “Allow service principals to use Power BI APIs” (and Admin APIs) is enabled. A full secret rotation sometimes also requires waiting for backend propagation or restarting the calling service.
Hi harshacollate,
Thank you for reaching out to the Microsoft Fabric Forum Community, and special thanks to rohit1991 for prompt and helpful responses.
Just following up to see if the Response provided by community members were helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.
Best regards,
Prasanna KumarHi @harshacollate,
Just following up to see if the Response provided by community members were helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.
Best regards,
Prasanna Kumar
