Trying to take ownership of imported dataset by service principal via REST API

[jaryszek]

Hi Guys,

I managed to set up all rest apis in Postman:
1. Get access token for my registered app service principal:

2. Get commands like :
GET https://api.powerbi.com/v1.0/myorg/groups

3. POST *.pbix into workspace: 

POST https://api.powerbi.com/v1.0/myorg/imports?datasetDisplayName={datasetDisplayName}

4. Get Import ID response in order to get underlying detaset id of imported report:

https://learn.microsoft.com/en-us/rest/api/power-bi/imports/get-import-in-group

But i stucked on this st API to take ownership of datasets (and in the next step update gateway permissions to blob storage and update parameters): 

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/Default.TakeOver

I am getting 403 error which means that I can not have access to do this. 

How to take ownership of imported report for service principal ?
What is missing here? 

Best,
Jacek

[nilendraFabric]

Hi @jaryszek 

Please try the folliwng steps: 

 Configure the Service Principal

• App Registration in Azure Active Directory (AAD):
  • Register your application in AAD and retrieve the Client ID, Client Secret, and Tenant ID.
  • Assign the necessary API permissions for Power BI, such as:
    • Tenant.Read.All (for read operations)
    • Tenant.ReadWrite.All (for write operations like POST or PATCH)
  • Grant admin consent for these permissions in AAD
• Enable Service Principal Usage in Power BI:
  • In the Power BI Admin Portal, under Tenant Settings > Developer Settings, enable "Allow service principals to use Power BI APIs."
  • Add the service principal to a security group and allow this group to use the Power BI APIs

2. Assign Permissions

• Ensure that the service principal is added as an Admin of the workspace where the dataset resides. Without admin access, you cannot perform ownership-related actions
• If you are using a data gateway, add the service principal as a user of the data source(s) and set it as an administrator of the gateway

3. Import Dataset

• Use the POST https://api.powerbi.com/v1.0/myorg/imports?datasetDisplayName={datasetDisplayName} endpoint to import your .pbix file into the workspace.
• Retrieve the dataset ID from the import response

4. Execute Default.TakeOver API Call

• Use the following endpoint to take ownership of the dataset:
  POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/Default.TakeOver
• Ensure that:
  • The access token used has sufficient permissions (Dataset.ReadWrite.All or equivalent).
  • The service principal is already an admin of the workspace.

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

[jaryszek]

---

Hello,

thanks! I have done first 3 steps without any issues. 

But this one: 

4. Execute Default.TakeOver API Call

• Use the following endpoint to take ownership of the dataset:
  POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/datasets/{datasetId}/Default.TakeOve
• Ensure that:
  • The access token used has sufficient permissions (Dataset.ReadWrite.All or equivalent).
  • The service principal is already an admin of the workspace.

---

How service principal can has access to DataSet.ReadWrite ? 
I need to take ownership for dataset by ServicePrincipal, not user!

Best,
Jacek

[v-saisrao-msft]

Hi  @jaryszek 

Thank you for reaching Microsoft Forum Community. 

In response to your query about transferring ownership of an imported dataset using a service principal via REST API, here are the steps to address your concern: 

• The service principal must have the Dataset.ReadWrite.All permission in Azure Active Directory. This is essential for the Default.TakeOver permission of API to function. Ensure admin consent is granted for these permissions in Azure AD. 
• The service principal needs Admin access to the Power BI workspace to take ownership of the dataset. Without it, ownership cannot be transferred. 
• confirm that the service principle is enabled in the Power BI Admin Portal under Tenant settings. Ensure it is allowed to use Power BI APIs and is part of the permitted security group if restrictions apply.
• Please verify the groupId (workspace ID) and datasetId (dataset ID) in the API call for accuracy.
  
  

Also, the links which you provided are not accessible. Below is the screenshot: 

If this helps, then please Accept it as a solution and dropping a "Kudos" so other members can find it more easily. 

Thank you

[jaryszek]

Hello,

thanks!

• The service principal needs Admin access to the Power BI workspace to take ownership of the dataset. Without it, ownership cannot be transferred. 
• confirm that the service principle is enabled in the Power BI Admin Portal under Tenant settings. Ensure it is allowed to use Power BI APIs and is part of the permitted security group if restrictions apply.
• Please verify the groupId (workspace ID) and datasetId (dataset ID) in the API call for accuracy.
  
  

---

These are done and checked.

But this one:

---

• The service principal must have the Dataset.ReadWrite.All permission in Azure Active Directory. This is essential for the Default.TakeOver permission of API to function. Ensure admin consent is granted for these permissions in Azure AD.
   

---

Is interesting. 
But  Dataset.ReadWrite.All permission is only delegated so behalf on user, not service principal. 
Is there possiblity to do this via Azure portal in some other way? Or only programatically in powerShell? 
If yes, how? 

Best,
Jacek

[v-saisrao-msft · Accepted solution]

Hi @jaryszek 

Thanks for your efforts and bringing back your concern to us. Below is the breakdown for your concerns also which helps in understating better. 

• After creating the Service Principal, it is essential to assign the necessary permissions for dataset access. Specifically, to enable Dataset.ReadWrite access, you must configure role-based access control (RBAC) in Microsoft Fabric. This can be achieved either directly within the workspace containing the dataset or by using an Azure role such as Contributor or Member, which provides the required dataset permissions. 

• In Microsoft Fabric, navigate to the workspace with the dataset and assign the appropriate role, such as Dataset.ReadWrite, to the Service Principal. Alternatively, you can manage permissions programmatically using the Power BI REST API by invoking the AddGroupDatasetUser API, specifying the Service Principal, and granting the necessary permissions. This will allow the Service Principal to modify or update the dataset. 

• To enable the Service Principal to take ownership of the dataset, you need to ensure it has admin or owner privileges. This will allow the Service Principal to manage the dataset, including updating or deleting it, and performing any actions that require ownership. Having ownership is essential for the Service Principal to perform advanced management tasks on the dataset. 

• Ownership can be granted through the Azure Portal, Power BI Admin Center, or programmatically using the Power BI API. You will need to invoke APIs like AddOrUpdateDatasetPermissions to assign the admin or owner role to the Service Principal for the dataset. This ensures the Service Principal has full control over the dataset. 

• After assigning the necessary permissions and ownership to the Service Principal, the next step is authentication. The Service Principal must authenticate using its client ID, tenant ID, and client secret. This process typically involves using OAuth to obtain an authentication token from Azure Active Directory. 

• Once authenticated, the Service Principal can use the access token to interact with Microsoft Fabric or Power BI via APIs. These APIs enable the Service Principal to manage datasets, apply changes, and maintain dataset ownership. 

If this post helps, please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.