refresh datasets sourced from dataflow using SPN

[J-Luc]

I'm publishing a PBI semantic model sourced from a Gen1 dataflow. The publication is done via a PowerShell script, in which I connect to Power BI with a service principal, publish the model, and perform a takeover. Then I modify the dataset parameters. Everything works correctly. The problem arises when refreshing the model, where I get a 403 error:

Data Source Error: DataSource.Error: Downstream service call to url 'https://api.powerbi.com/powerbi/globalservice/v201606/clusterdetails' failed with status code 403.

The service principal has administrator privileges in the workspaces where the model and dataflow are stored.

Note: Refreshing works without issue if I publish via the desktop using a user account.

I then tried modifying the SPN credentials via a script, but while the script executes correctly, the refresh still fails.

Has anyone else ever encountered this situation?

Thanx for your help

[v-echaithra]

Hi @J-Luc ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-echaithra]

Hi @J-Luc ,

We’d like to follow up regarding the recent concern. Kindly confirm whether the issue has been resolved, or if further assistance is still required. We are available to support you and are committed to helping you reach a resolution.

Best Regards,
Chaithra E.

[MohdZaid_ · Accepted solution]

Hey @J-Luc  , 

This 403 error when refreshing a dataset using a Service Principal (SPN) usually boils down to permission issues even if it looks like your SPN already has admin rights.

Here’s what’s happening and how to fix it in plain terms:

• Just having admin rights in the workspace isn’t always enough. Your SPN needs explicit access to both the workspace where the dataset lives and the workspace where the dataflow lives (if they’re different). Without that, Power BI blocks the refresh with a 403 error.
• The SPN also needs to be properly registered and granted permission in Azure AD to call Power BI APIs. This means in the Azure Portal, it should have the right API permissions with admin consent. Otherwise, it can’t communicate with Power BI services fully.
• On top of that, the SPN must have access to the dataflow itself. Sometimes you need to go into the Power BI Service UI and share the dataflow or assign rights directly to the SPN. If the SPN can’t “see” the dataflow, it can’t pull data during refresh.
• When you update dataset credentials via script, make sure you’re setting the data source to use OAuth2 authentication tied to the SPN. If that’s not set correctly, the refresh will fail even if permissions are right.
• Refresh works with a user account because users usually have broader default permissions, but SPNs require these explicit, step-by-step permission assignments.
• If you’re using older Gen1 dataflows or capacities, consider moving to Premium or Gen2 workspaces if possible, as they handle SPN permissions more smoothly.

So, to summarize:

• Double-check your SPN has Member or Admin roles on both workspaces involved.
• Confirm it’s authorized in Azure AD with Power BI API permissions granted.
• Share or assign access to the dataflow itself for the SPN.
• Ensure your script updates the dataset credentials to use SPN OAuth tokens properly.

[GilbertQ]

Hi @J-Luc 

What I would recommend doing is making sure you can set up a shared data source connection that can use the service principal to authenticate and then when you are uploading your semantic model you use the shared source connection so that you don't have to implicitly change the connection settings.