Unable to Add Service Principal to Power BI Workspace Using Power BI REST API (403 Forbidden Error)

Issue:
Service Principal Name (SPN)Power BI REST APIInvoke-RestMethod403 Forbidden

Registered an App in Azure ADAPI permissions

Workspace Read all

Wokspace Readwrite all

Enabled "Allow service principals to use Power BI APIs"Power BI Admin Tenant Settings

Generated an access token

$tenantId = "<Tenant-ID>"
$clientId = "<App-Client-ID>"
$clientSecret = "<App-Client-Secret>"
$tokenUrl = "https://login.microsoftonline.com/$tenantId/oauth2/token"

$body = @{
    client_id     = $clientId
    client_secret = $clientSecret
    resource      = "https://graph.microsoft.com"
    grant_type    = "client_credentials"
}

$response = Invoke-RestMethod -Uri $tokenUrl -Method Post -Body $body -ContentType "application/x-www-form-urlencoded"
$accessToken = $response.access_token

$workspaceId = "<Workspace-ID>"
$spnObjectId = "<SPN-Object-ID>"  # From Azure AD
$role = "Admin"

$uri = "https://api.powerbi.com/v1.0/myorg/groups/$workspaceId/users"

$headers = @{
    Authorization = "Bearer $accessToken"
    "Content-Type" = "application/json"
}

$body = @{
    identifier = $spnObjectId
    principalType = "App"
    accessRight = $role
} | ConvertTo-Json -Depth 3

Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body $body

  ---------------------------------------------------------------------------------------------------------------------------------------------

Error Message:

Invoke-RestMethod : The remote server returned an error: (403) Forbidden.

At C:\Users\...\SPN.ps1:36 char:1

+ Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body $bod ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest)

+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

1. Are there additional Power BI Admin settings required for SPNs to manage workspaces?

2. Is there a specific API scope required when generating an access token for this operation?

Any guidance would be appreciated. Thank you! 😊

 Arioli_Chezhian danextian Ritaf1983 rajendraongole1