refresh datasets sourced from dataflow using SPN

Hey J-Luc  , 

This 403 error when refreshing a dataset using a Service Principal (SPN) usually boils down to permission issues even if it looks like your SPN already has admin rights.

Here’s what’s happening and how to fix it in plain terms:

• Just having admin rights in the workspace isn’t always enough. Your SPN needs explicit access to both the workspace where the dataset lives and the workspace where the dataflow lives (if they’re different). Without that, Power BI blocks the refresh with a 403 error.
• The SPN also needs to be properly registered and granted permission in Azure AD to call Power BI APIs. This means in the Azure Portal, it should have the right API permissions with admin consent. Otherwise, it can’t communicate with Power BI services fully.
• On top of that, the SPN must have access to the dataflow itself. Sometimes you need to go into the Power BI Service UI and share the dataflow or assign rights directly to the SPN. If the SPN can’t “see” the dataflow, it can’t pull data during refresh.
• When you update dataset credentials via script, make sure you’re setting the data source to use OAuth2 authentication tied to the SPN. If that’s not set correctly, the refresh will fail even if permissions are right.
• Refresh works with a user account because users usually have broader default permissions, but SPNs require these explicit, step-by-step permission assignments.
• If you’re using older Gen1 dataflows or capacities, consider moving to Premium or Gen2 workspaces if possible, as they handle SPN permissions more smoothly.

So, to summarize:

• Double-check your SPN has Member or Admin roles on both workspaces involved.
• Confirm it’s authorized in Azure AD with Power BI API permissions granted.
• Share or assign access to the dataflow itself for the SPN.
• Ensure your script updates the dataset credentials to use SPN OAuth tokens properly.