Forum Discussion

MarkH's avatar
MarkH
Icon for Helper I rankHelper I
1 year ago
Solved

extracting permissions from the service using powershell

Using the following powershell script I can extract user information and then use powerquery on the result to extract WORKSPACE level permissions. I wish to extract App level permissions and possibly permissions at dataset, report and dashboard levels.

Can this be done in powershell? Is it just a case of navigating to the collect URL? I have tried navigating to /reports and /dashboards and /apps but when I expand the users column, in powerquery, it always comes back blank.

 

Or is there an easier way of summarising and reporting all of the permissions at every object level (WS,app,dashboard,report,dataset)? 

 

#################

#Sign in with Power BI Admin Account of SPN with TenantRead.All permissions
Connect-PowerBIServiceAccount

#Get Workspace info for top 1500 workspaces (if more, adjust call and include skip parameter)
#This call only looks at WS users, datasets and reports.
$GetWorkspaceInfo = Invoke-PowerBIRestMethod -Method GET -Url "https://api.powerbi.com/v1.0/myorg/admin/groups?%24top=1500&%24expand=users%2Cdatasets%2Creports"

#Save the WS info to json file on desktop. Please adjust output location accordingly.
$OutputPath = "C:\temp\Workspaces_output.json"
$GetWorkspaceInfo | Out-File $OutputPath

Write-Host "Workspace information exported to $OutputPath"

#################

  • MarkH's avatar
    MarkH
    1 year ago

    Thnaks for your help everyone. This is what i ended up with for finding App permissions. 🙂

     

    ####################

    # Connect to Power BI Service
    Connect-PowerBIServiceAccount

    # Define the API endpoint to get all apps
    $appsApiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps?%24top=150"

    # Get the list of all apps
    $appsResponse = Invoke-PowerBIRestMethod -Url $appsApiUrl -Method Get

    # Parse the JSON response
    $responseJson = $appsResponse | ConvertFrom-Json

    # Extract the app data from the parsed JSON
    $apps = $responseJson.value

    # Extract id, name, and workspaceId
    $filteredapps = $apps | Select-Object -Property id, name, workspaceId

    # Initialize an array to hold the final output
    $finalOutput = @()

    # Loop through each app and get the users
    foreach ($app in $filteredapps) {
    $appId = $app.id
    $appName = $app.name
    $apiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps/$appId/users"

    # Get the list of users for the current app
    $response = Invoke-PowerBIRestMethod -Url $apiUrl -Method Get

    # Parse the JSON response
    $appusers = $response | ConvertFrom-Json

    # Create a custom object for the app and its users
    $appData = [PSCustomObject]@{
    AppId = $appId
    AppName = $appName
    Users = $appusers.value
    }

    # Add the custom object to the final output array
    $finalOutput += $appData
    }

    # Convert the final output array to JSON
    $finalOutputJson = $finalOutput | ConvertTo-Json -Depth 3

    # Output the final JSON to a file
    $finalOutputJson | Out-File -FilePath "C:\temp\apps_user_access.json"

    ####################

3 Replies

    • MarkH's avatar
      MarkH
      Icon for Helper I rankHelper I

      Thnaks for your help everyone. This is what i ended up with for finding App permissions. 🙂

       

      ####################

      # Connect to Power BI Service
      Connect-PowerBIServiceAccount

      # Define the API endpoint to get all apps
      $appsApiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps?%24top=150"

      # Get the list of all apps
      $appsResponse = Invoke-PowerBIRestMethod -Url $appsApiUrl -Method Get

      # Parse the JSON response
      $responseJson = $appsResponse | ConvertFrom-Json

      # Extract the app data from the parsed JSON
      $apps = $responseJson.value

      # Extract id, name, and workspaceId
      $filteredapps = $apps | Select-Object -Property id, name, workspaceId

      # Initialize an array to hold the final output
      $finalOutput = @()

      # Loop through each app and get the users
      foreach ($app in $filteredapps) {
      $appId = $app.id
      $appName = $app.name
      $apiUrl = "https://api.powerbi.com/v1.0/myorg/admin/apps/$appId/users"

      # Get the list of users for the current app
      $response = Invoke-PowerBIRestMethod -Url $apiUrl -Method Get

      # Parse the JSON response
      $appusers = $response | ConvertFrom-Json

      # Create a custom object for the app and its users
      $appData = [PSCustomObject]@{
      AppId = $appId
      AppName = $appName
      Users = $appusers.value
      }

      # Add the custom object to the final output array
      $finalOutput += $appData
      }

      # Convert the final output array to JSON
      $finalOutputJson = $finalOutput | ConvertTo-Json -Depth 3

      # Output the final JSON to a file
      $finalOutputJson | Out-File -FilePath "C:\temp\apps_user_access.json"

      ####################

  • Expiscornovus's avatar
    Expiscornovus
    Icon for Most Valuable Professional rankMost Valuable Professional

    Hi MarkH,

     

    Just to double check. Did you try the expand value with single quotes instead of double quotes for your Url parameter value?

     

    My experience is that it seems not to like the $top & $expand query parameters (it is highlighted as green). With single quotes it will recognize it as text.

     

    See the below example where I used the same URL with single and double quotes in PowerShell