Title:
Getting "Insufficient permissions" error while saving semantic model changes using TOM and service principal
Body:
Hi everyone,
I'm working on a solution to add a DAX measure programmatically to a Power BI dataset using the Tabular Object Model (TOM) via a service principal. The datasets are hosted in a Premium capacity workspace.
Below are the steps I follow, including relevant code:
1. Connection string:
Data Source=powerbi://api.powerbi.com/v1.0/myorg/{workspaceName};
User ID=app:{_clientId}@{_tenantId};
Password={_clientSecret};2. Connecting to the server:
server.Connect(connectionString);
3. Connecting to the database:
Tabular.Database? database = server.Databases
.Cast<Tabular.Database>()
.FirstOrDefault(db => db.Name.Equals(datasetName, StringComparison.OrdinalIgnoreCase));
if (database == null)
return;4. Accessing the model:
Tabular.Model model = database.Model;
5. Finding the table:
var table = model.Tables.Find(tableName);
6. Checking if the measure already exists:
var existingMeasure = table.Measures.Find(measureName);
7. Creating a new measure:
var newMeasure = new Tabular.Measure
{
Name = measureName,
Expression = measureExpression,
FormatString = "#,0"
};8. Adding the measure to the table:
table.Measures.Add(newMeasure);
9. Saving the model changes:
model.SaveChanges();
Problem:
While this works for some datasets, it fails for others with the following error:
"Failed to save modifications to the server. Error returned: 'The request to alter the semantic model was rejected because of insufficient permissions. In addition to Write permissions on the model, make sure you also have at least Use permissions on all data connections that the semantic model uses. Verify the connection configuration in the semantic model settings and contact the connection owner(s) to grant you the required permissions.'"
What I've verified:
The service principal has ReadWrite permissions on both the workspace and dataset.
The dataset is hosted in a Premium capacity.
The same process and permissions work for other datasets.
Questions:
What could be causing this inconsistency between datasets?
How do I verify or assign "Use permissions" for all data sources to the service principal?
Is there a way to programmatically check permissions or data source access before calling SaveChanges()?
Any guidance or insights would be appreciated. Thanks!
