Forum Discussion

MohitMakhija199's avatar
MohitMakhija199
Microsoft Employee
2 years ago
Solved

Unable to get Token for deployment using powershell.

I am trying to deploy notebooks, lakehouses and powerbi reports using the fabric rest api : Items - Create Notebook - REST API (Notebook) | Microsoft Learn
I saw some samples in the github repository on how to get the token for fabric : fabric-samples/features-samples/fabric-apis/LongRunningOperation-Polling.ps1 at main · microsoft/fabric-samples (github.com)

but the token I get when using https://api.fabric.microsoft.com is user_impersonation token which is not able to perform get or even list calls.
below is my code


 

 

 

$global:baseUrl = "https://api.fabric.microsoft.com/v1"
$global:resourceUrl = "https://api.fabric.microsoft.com"
$global:fabricHeaders = @{}
$global:GetNotebooksUrl = "{0}/workspaces/{1}/notebooks"

function SetFabricHeaders() {
    # Login to Azure
    Connect-AzAccount -AuthScope  -Tenant '72f988bf-86f1-41af-91ab-2d7cd011db47' | Out-Null

    # Get authentication
    $fabricToken = (Get-AzAccessToken -ResourceUrl $global:resourceUrl).Token

    $global:fabricHeaders = @{
        'Content-Type' = "application/json"
        'Authorization' = "Bearer {0}" -f $fabricToken
    }
}

try {
    SetFabricHeaders
    $workspaceId = ""
    $get_notebooks_url = $global:GetNotebooksUrl -f $global:baseUrl, $workspaceId
    Write-Host $global:fabricHeaders
    Write-Host "Getting notebooks from workspace: $get_notebooks_url"
    $operationState = Invoke-RestMethod -Headers $global:fabricHeaders -Uri $get_notebooks_url -Method GET
    Write-Host "Notebooks : $($operationState)"
}
catch {
    $errorResponse = GetErrorResponse($_.Exception)
    Write-Host "Failed to Perform request. Error reponse: $errorResponse" -ForegroundColor Red
}

 

 

 


I want to get token which has read and write scopes over workspace. 

  • I took a slightly different stance on this, which might be able to help you out.

     

    For one pipeline I commented out the connect-azaccount in the PowerShell script and connected to it outside of the script instead using a service principal account as below:

     

                      $SecureStringPwd = ConvertTo-SecureString $(servicePrincipalKey) -AsPlainText -Force
                      $pscredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $(servicePrincipalId), $SecureStringPwd
                      
                      Connect-AzAccount -ServicePrincipal -Credential $pscredential -Tenant $(tenantId)
     
    I then ran the script with the commented out line afterwards.
     
    Let me know if that helps.

2 Replies

  • I took a slightly different stance on this, which might be able to help you out.

     

    For one pipeline I commented out the connect-azaccount in the PowerShell script and connected to it outside of the script instead using a service principal account as below:

     

                      $SecureStringPwd = ConvertTo-SecureString $(servicePrincipalKey) -AsPlainText -Force
                      $pscredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $(servicePrincipalId), $SecureStringPwd
                      
                      Connect-AzAccount -ServicePrincipal -Credential $pscredential -Tenant $(tenantId)
     
    I then ran the script with the commented out line afterwards.
     
    Let me know if that helps.
  • MohitMakhija199's avatar
    MohitMakhija199
    Microsoft Employee

    Thanks KevinChant for the answer, 

    using service principal solution also works as you have shown, in my case also, there was a slight parsing error of the response, but the token works fine. 
    Developers can use both ways to get the token and automate their deployments.