Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Get certified in Microsoft Fabric—for free! For a limited time, get a free DP-600 exam voucher to use by the end of 2024. Register now

Reply
jihool3670
Helper I
Helper I

Service principal authentication for Web Connection throws OAuth error

Hi,

 

I'm trying to replicate the ADF pipeline from this blog which involves connecting to the Power BI/Fabric Admin API (https://api.powerbi.com/v1.0/myorg/admin/). I'm following this documentation to create a Web connection but the connection fails with the error below. It's not clear to me why the error references OAuth when I'm trying to use a service principal.

 

I did notice that when creating a REST linked service in ADF, you have to specify the AAD resource (AAD resource: https://analysis.windows.net/powerbi/api), but that is does not seem possible in Fabric (yet). Perhaps that's the cause of error?

 

Thanks!

Web OAuth Error.png

 

 

 

1 ACCEPTED SOLUTION
jihool3670
Helper I
Helper I

This issue is resolved as the Web V2 connection now allows for service principal auth. For those wondering, the "Token Audience URI" is the same thing as the "AAD Resource" and in this scenario, https://analysis.windows.net/powerbi/api is the correct value for that parameter.

View solution in original post

12 REPLIES 12
jihool3670
Helper I
Helper I

This issue is resolved as the Web V2 connection now allows for service principal auth. For those wondering, the "Token Audience URI" is the same thing as the "AAD Resource" and in this scenario, https://analysis.windows.net/powerbi/api is the correct value for that parameter.

Lorenz33
Helper III
Helper III

I was about to log a ticket but see that jihool3670 had the exact same issue a year ago. Has anyone had success in getting this to work?

 

For the past year I have been retrieving Power BI Audit from the Power BI Activity log using Power BI Managememnt cmdlets for Powershell. I ran a Powershell script that that retrieved a days worth of Audit data to a json file and then ran an SSIS package to move the data to an SQL Server database.

 

Our organization now has MS Fabric. I want to utilize the features and update the process to using MS Fabric Data Factory to retrieve Power BI Activity data and move it to a database.

 

I had a service principal created and added it to an Azure AD group. In the Power BI tenant settings, I then enabled permissions to this group for "Service principals can use Fabric APIs". I am trying to follow the instructions from this blog and following this documentation. The exact same scenario as jihool3670.

 

I tried creating a connection using Web as the connection type and Service Principal as the Authentication method.  I used "https://api.powerbi.com/v1.0/myorg/admin/" as the base URL. Creation fails with the same message originally posted "Unable to create connection for the following resaon: Failed to login with OAuth token, please update the credential manually and retry."

 

With the base URL I left myorg as is. Should I have replaced it with something else?

 

I have also tried creating a web2 connection and it fails with the same message. I left "Token Audience Uri" blank as I do not know what it is and could not find it anywhere or where to find it.

 

How could I get this working? Can this be done in MS Fabric? If not, has anyone got this working in Azure Data Factory using a Linked Service?

kalyanrk61
Microsoft Employee
Microsoft Employee

Hi , Are you trying to use Web Activity? if yes web activity works with Web V2 Connection, pls try use that, you will see option for Token Audience 

Thanks for the suggestion!

 

I am able to successfully create a Web V2 connection and I am able to select that connection in both the Web and Webhook activities in a Fabric pipeline.

 

However, I want to use the Copy Activity rather than the Web activity. When I add a Copy Activity to the canvas, I don't see my newly created V2 web connection as an option in the Source connection drop down, even after refreshing the list of the connections.

 

Additionally, when I try to create a new connection from within the Copy Acitivity, boththe REST and HTTP connections only have Anonymous and Basic as their authentication options and don't include service principal authentication.

 

jihool3670_0-1693862342762.png


It seems like this is just a current limitation of the Copy Activity at this point in time but I haven't been able to any documentation around current limitations so I'd love confirmation (and ideally a sense of when to expect this functionality).

Charline_74
Helper III
Helper III

Hi @jihool3670

Have you found a solution to your problem, as I have exactly the same problem?

Thanks in Advance, 

Charline

Hi Charline - No, not yet. It seems to be a limitation of the copy activity authentication options in Fabric at the moment.


@makromer can you confirm Fabric pipelines can't authenticate to the Fabric/Power BI admin API at this point in time?

jihool3670
Helper I
Helper I

Yes I should have mentioned that. I have successfully used the service principal to access that specific API using a Spark notebook. I tried the credentials multiple times to make sure it wasn't a copy/paste error when creating the web connection. 

Hi,

I also notice your screenshot of the new connection window doesn't make very clear where the service principal is set on the connection.


Kind Regards,

Dennes

Here is the complete screenshot:

Web OAuth Error.png

Hi,

Maybe I can help a bit with the error message. "why it mentions OAUTH".

 

The authentication process needs to contact Azure and retrieve an authentication token for the service principal. Once Azure is contacted, this token is presented to the Power BI Admin API you are calling for authentication. Basically, this is an OAUTH authentication/authorization process.

 

The error message is clear: The service principal permission is denied. It's difficult to say if it's denied on the first step (while authenticating on Azure) or on the 2nd step (while authenticating against the power bi admin). But if I had to guess, it's the 2nd step. Permissions to access the Power BI Admin.

You mentioned you did this access from other places before, such as a notebook. I would double check if the information is all correct, because it's easy to mistype something: The tenantId, the service principal Id and the key.


If you double check it and everything is right, explaining why it works in one place and not in other is a bit more difficult. Maybe if you show both to compare we can come up with something.

 

Kind Regards,

 

Dennes

Thanks for the detail. I'll post screenshots when I'm at my PC.

 

Prior to trying with a Fabric pipeline, I was successful in using an ADF copy activity using the same SP. The difference was I was able to specify an AAD resource when creating the linked service. Is that not relevant with Farbic?

 

https://learn.microsoft.com/en-us/azure/data-factory/connector-rest?tabs=data-factory#use-service-pr...

DennesTorres
Impactful Individual
Impactful Individual

Hi,

You mentioned you are using a service principal. Did you give the service principal the permissions on power bi to access the API's ?

 

Kind Regards,

 

Dennes

Helpful resources

Announcements
November Carousel

Fabric Community Update - November 2024

Find out what's new and trending in the Fabric Community.

Live Sessions with Fabric DB

Be one of the first to start using Fabric Databases

Starting December 3, join live sessions with database experts and the Fabric product team to learn just how easy it is to get started.

November Update

Fabric Monthly Update - November 2024

Check out the November 2024 Fabric update to learn about new features.

Las Vegas 2025

Join us at the Microsoft Fabric Community Conference

March 31 - April 2, 2025, in Las Vegas, Nevada. Use code MSCUST for a $150 discount! Early Bird pricing ends December 9th.