Forum Discussion

MartinMason's avatar
MartinMason
Resolver I
1 year ago
Solved

Update from Git - Azure Devops Pipeline

I'm trying to construct an Azure Devops pipeline to orchestrate our deployment process. One of the first steps I need to accomplish is to update our Development workspace from Git. I was thinking it could be done by calling the updateFromGit Fabric REST API method. Unfortunately, while I believe I have an YAML script that works, that method will not work with Service Principals. Has anyone actually gotten something like this to work? Seems to me, this is an enormously huge miss in Microsoft's CI/CD strategy with Fabric.

 

- powershell: |
    $body = @{
      client_id = "$(PBI_CLIENT_ID)"
      scope = "https://api.fabric.microsoft.com/.default"
      client_secret = "$(PBI_CLIENT_SECRET)"
      grant_type = "client_credentials"
    }
    $response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$(PBI_TENANT_ID)/oauth2/v2.0/token" -Method Post -ContentType "application/x-www-form-urlencoded" -Body $body
    $token = $response.access_token
    $headers = @{
      Authorization = "Bearer $token"
      "Content-Type" = "application/json"
    }
    $body = @{
      remoteCommitHash = "$(GIT_COMMIT_HASH)"
      conflictResolution = @{
        conflictResolutionType = "Workspace"
        conflictResolutionPolicy = "PreferWorkspace"
      }
      options = @{
        allowOverrideItems = $true
      }
    }
    Invoke-RestMethod -Uri "https://api.fabric.microsoft.com/v1/workspaces/$(PBI_WORKSPACE_ID)/git/updateFromGit" -Method Post -Headers $headers -Body ($body | ConvertTo-Json -Compress)
  displayName: 'Update Power BI Workspace from Git'
  • Hi, MartinMason 

    Update your pipeline's PowerShell script to use the PAT instead of trying to authenticate via Service Principal.

    - powershell: |
        $pat = "$(PAT)"  # Your PAT stored securely in Azure DevOps
        $headers = @{
          Authorization = "Bearer $pat"
          "Content-Type" = "application/json"
        }
        $body = @{
          remoteCommitHash = "$(GIT_COMMIT_HASH)"
          conflictResolution = @{
            conflictResolutionType = "Workspace"
            conflictResolutionPolicy = "PreferWorkspace"
          }
          options = @{
            allowOverrideItems = $true
          }
        }
        Invoke-RestMethod -Uri "https://api.fabric.microsoft.com/v1/workspaces/$(PBI_WORKSPACE_ID)/git/updateFromGit" -Method Post -Headers $headers -Body ($body | ConvertTo-Json -Compress)
      displayName: 'Update Power BI Workspace from Git'
    

    For now, the PAT approach or interactive user authentication are your best bets to achieve the desired functionality. Both have their pros and cons, but they can enable automated deployments until Microsoft officially supports Service Principal authentication for this endpoint.

     

9 Replies

  • hackcrr's avatar
    hackcrr
    Memorable Member

    Hi, MartinMason 

    Update your pipeline's PowerShell script to use the PAT instead of trying to authenticate via Service Principal.

    - powershell: |
        $pat = "$(PAT)"  # Your PAT stored securely in Azure DevOps
        $headers = @{
          Authorization = "Bearer $pat"
          "Content-Type" = "application/json"
        }
        $body = @{
          remoteCommitHash = "$(GIT_COMMIT_HASH)"
          conflictResolution = @{
            conflictResolutionType = "Workspace"
            conflictResolutionPolicy = "PreferWorkspace"
          }
          options = @{
            allowOverrideItems = $true
          }
        }
        Invoke-RestMethod -Uri "https://api.fabric.microsoft.com/v1/workspaces/$(PBI_WORKSPACE_ID)/git/updateFromGit" -Method Post -Headers $headers -Body ($body | ConvertTo-Json -Compress)
      displayName: 'Update Power BI Workspace from Git'
    

    For now, the PAT approach or interactive user authentication are your best bets to achieve the desired functionality. Both have their pros and cons, but they can enable automated deployments until Microsoft officially supports Service Principal authentication for this endpoint.

     

    • MartinMason's avatar
      MartinMason
      Resolver I

      I guess you're correct. Seems kinda hackish as the PAT variable value would have to be updated before the pipeline is triggered. Interactive user authentication is not possible as 2FA is enabled for everything in our environment.

       

      I was hoping to trigger the Azure Devops pipeline upon completion of a pull request to master. However, I guess for now, the pipeline will have to be triggered manually and the Power BI access token configured as a required parameter value upon pipeline execution.

      • v-nmadadi-msft's avatar
        v-nmadadi-msft
        Community Support

        Hi MartinMason ,
        Please check out this link where you can submit the features you would like to have 
        https://ideas.fabric.microsoft.com/
        Consider submiting your feature request if you think that will be helpful.

        If you found hackcrr's solution helpful please accept their solution so as to help other community members who may face similar issue in the future.

        Thanks and regards

  • you can also use Tabular Editor CLI to Deploy your Model using this service Principle Account.

    and benefit from Best Practice Analyzer.

     

  • ayushpandey's avatar
    ayushpandey
    Frequent Visitor

    Hi MartinMason,

    I am trying to create a similar pipeline, can you tell me how to get the value for GIT_COMMIT_HASH variable.

    • MartinMason's avatar
      MartinMason
      Resolver I

      Most of what I'm using, I'm pilfering from this page: 

      Automate Git integration by using APIs - Microsoft Fabric | Microsoft Learn

      The call to the workspaces/$workspaceId/git/status endpoint will return the remoteCommitHash and the workspaceHead value that need to be included in the body of the call to the workspaces/$workspaceId/git/updateFromGit endpoint. It's a long running operation so it'll return a 202 status code with the operation id that you'll need to check periodically to determine the status. Currently, we have to run it with the credentials of the semantic model/paginated report owner so it's of limited use in a triggered scenario

  • ayushpandey's avatar
    ayushpandey
    Frequent Visitor

    I am getting the following error when updating fabric workspace using the gitupdate API. In this scenario I have to manually tick the checkbox and continue. Is there any way to automate this process

     

     

     

     

     

     

     

     

  • crisvaillant's avatar
    crisvaillant
    Frequent Visitor

    Hi everyone,

    I followed the script shared in this thread to update a Power BI workspace from Git using Azure DevOps as the source control. However, I encountered the following error:

     

    Invoke-RestMethod: The operation is not supported for the principal type
    "PrincipalTypeNotSupported"
    "resourceType": "AzureDevOpsSourceControl"

     

    After further investigation, I realized that Microsoft Fabric currently supports Git-based deployments only when using GitHub as the single source of truth. Azure DevOps as a source control type is not supported at this moment.

    Could someone from the Microsoft Fabric team or the community confirm whether there are plans to support Azure DevOps as a source control in the future? It would be extremely helpful to know if this feature is on the roadmap.

    Any insights or updates would be greatly appreciated!

    Thank you in advance!