Forum Discussion
ServicePrincipalIsNotAllowedByTenantAdminSwitch on Pro capacity
Hi,
We are using logic apps to trigger semantic model datafreshes on the correct moments via : https://api.powerbi.com/v1.0/myorg/groups/<>/datasets/<>/refreshes
Previously we were using Premium capacity and this configuration was working like a charm, with migration to Fabric capacity we are also starting to use Pro capacity workspaces but for those workspaces we cannot get this to work.
When we try to trigger the refresh the response is an error : ServicePrincipalIsNotAllowedByTenantAdminSwitch.
Do note that we don't add a payload to the request for Pro capacity workspaces so it should only be triggering a standard refresh on the specified dataset in the specified workspace. We should not trigger an enhanced refresh because no body/payload is part of the request. See also:
https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/refresh-dataset-in-group
We read some topics that it may be required to revalidate the Allow Service Principals Tenant Admin switch via the PowerBI Admin page but it works for Fabric workspaces so this sounds strange to us.
Please advice.
Thanks in advance for the response!
Hello hhout ,
This is purely a tenant permission issue for the service principal (SP). Even if the SP is added as an admin or member of a Pro workspace, it cannot use the APIs unless the tenant admin has enabled the “Allow service principals” setting and (if scoped) included the SP’s security group.
Could you check if this setting is enabled:
Power BI Admin Portal -> Tenant Settings -> Allow service principals to use Power BI APIs
If it’s enabled but only scoped to certain security groups, make sure the service principal calling the API is included.
If this solved your issue, please mark it as the accepted solution. ✅
2 Replies
Hello hhout ,
This is purely a tenant permission issue for the service principal (SP). Even if the SP is added as an admin or member of a Pro workspace, it cannot use the APIs unless the tenant admin has enabled the “Allow service principals” setting and (if scoped) included the SP’s security group.
Could you check if this setting is enabled:
Power BI Admin Portal -> Tenant Settings -> Allow service principals to use Power BI APIs
If it’s enabled but only scoped to certain security groups, make sure the service principal calling the API is included.
If this solved your issue, please mark it as the accepted solution. ✅
Hi, you are correct. After raising some additional questions and searching the Security Groups I found out this setup was in use. After adding the Service Principal as a member in the Azure Security Group it works so I can confirm that triggering a standard refresh on a specified (semantic model) dataset in a Pro workspace works. Thanks for the guidance on this topic!
