extracting permissions from the service using powershell

[MarkH]

Using the following powershell script I can extract user information and then use powerquery on the result to extract WORKSPACE level permissions. I wish to extract App level permissions and possibly permissions at dataset, report and dashboard levels.

Can this be done in powershell? Is it just a case of navigating to the collect URL? I have tried navigating to /reports and /dashboards and /apps but when I expand the users column, in powerquery, it always comes back blank.

Or is there an easier way of summarising and reporting all of the permissions at every object level (WS,app,dashboard,report,dataset)? 

#################

#Sign in with Power BI Admin Account of SPN with TenantRead.All permissions
Connect-PowerBIServiceAccount

#Get Workspace info for top 1500 workspaces (if more, adjust call and include skip parameter)
#This call only looks at WS users, datasets and reports.
$GetWorkspaceInfo = Invoke-PowerBIRestMethod -Method GET -Url "https://api.powerbi.com/v1.0/myorg/admin/groups?%24top=1500&%24expand=users%2Cdatasets%2Creports"

#Save the WS info to json file on desktop. Please adjust output location accordingly.
$OutputPath = "C:\temp\Workspaces_output.json"
$GetWorkspaceInfo | Out-File $OutputPath

Write-Host "Workspace information exported to $OutputPath"

#################

[Expiscornovus]

Hi @MarkH,

Just to double check. Did you try the expand value with single quotes instead of double quotes for your Url parameter value?

My experience is that it seems not to like the $top & $expand query parameters (it is highlighted as green). With single quotes it will recognize it as text.

See the below example where I used the same URL with single and double quotes in PowerShell

[ibarrau]

Hi. Apps api doesn't work like workspaces. You can get them and the users. But it's different. First you should get all the apps you want to check users and then loop them one by one running:

https://learn.microsoft.com/en-us/rest/api/power-bi/admin/apps-get-app-users-as-admin

That way you can get users from an app.

I hope that helps,

[MarkH · Accepted solution]

Thnaks for your help everyone. This is what i ended up with for finding App permissions. 🙂

####################

# Connect to Power BI Service
Connect-PowerBIServiceAccount

# Define the API endpoint to get all apps
$appsApiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps?%24top=150"

# Get the list of all apps
$appsResponse = Invoke-PowerBIRestMethod -Url $appsApiUrl -Method Get

# Parse the JSON response
$responseJson = $appsResponse | ConvertFrom-Json

# Extract the app data from the parsed JSON
$apps = $responseJson.value

# Extract id, name, and workspaceId
$filteredapps = $apps | Select-Object -Property id, name, workspaceId

# Initialize an array to hold the final output
$finalOutput = @()

# Loop through each app and get the users
foreach ($app in $filteredapps) {
$appId = $app.id
$appName = $app.name
$apiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps/$appId/users"

# Get the list of users for the current app
$response = Invoke-PowerBIRestMethod -Url $apiUrl -Method Get

# Parse the JSON response
$appusers = $response | ConvertFrom-Json

# Create a custom object for the app and its users
$appData = [PSCustomObject]@{
AppId = $appId
AppName = $appName
Users = $appusers.value
}

# Add the custom object to the final output array
$finalOutput += $appData
}

# Convert the final output array to JSON
$finalOutputJson = $finalOutput | ConvertTo-Json -Depth 3

# Output the final JSON to a file
$finalOutputJson | Out-File -FilePath "C:\temp\apps_user_access.json"

####################