Service principal authentication for Web Connection throws OAuth error

[jihool3670]

Hi,

I'm trying to replicate the ADF pipeline from this blog which involves connecting to the Power BI/Fabric Admin API (https://api.powerbi.com/v1.0/myorg/admin/). I'm following this documentation to create a Web connection but the connection fails with the error below. It's not clear to me why the error references OAuth when I'm trying to use a service principal.

I did notice that when creating a REST linked service in ADF, you have to specify the AAD resource (AAD resource: https://analysis.windows.net/powerbi/api), but that is does not seem possible in Fabric (yet). Perhaps that's the cause of error?

Thanks!

[jihool3670 · Accepted solution]

This issue is resolved as the Web V2 connection now allows for service principal auth. For those wondering, the "Token Audience URI" is the same thing as the "AAD Resource" and in this scenario, https://analysis.windows.net/powerbi/api is the correct value for that parameter.

[Lorenz33]

I was about to log a ticket but see that jihool3670 had the exact same issue a year ago. Has anyone had success in getting this to work?

For the past year I have been retrieving Power BI Audit from the Power BI Activity log using Power BI Managememnt cmdlets for Powershell. I ran a Powershell script that that retrieved a days worth of Audit data to a json file and then ran an SSIS package to move the data to an SQL Server database.

Our organization now has MS Fabric. I want to utilize the features and update the process to using MS Fabric Data Factory to retrieve Power BI Activity data and move it to a database.

I had a service principal created and added it to an Azure AD group. In the Power BI tenant settings, I then enabled permissions to this group for "Service principals can use Fabric APIs". I am trying to follow the instructions from this blog and following this documentation. The exact same scenario as jihool3670.

I tried creating a connection using Web as the connection type and Service Principal as the Authentication method.  I used "https://api.powerbi.com/v1.0/myorg/admin/" as the base URL. Creation fails with the same message originally posted "Unable to create connection for the following resaon: Failed to login with OAuth token, please update the credential manually and retry."

With the base URL I left myorg as is. Should I have replaced it with something else?

I have also tried creating a web2 connection and it fails with the same message. I left "Token Audience Uri" blank as I do not know what it is and could not find it anywhere or where to find it.

How could I get this working? Can this be done in MS Fabric? If not, has anyone got this working in Azure Data Factory using a Linked Service?

[kalyanrk61]

Hi , Are you trying to use Web Activity? if yes web activity works with Web V2 Connection, pls try use that, you will see option for Token Audience 

[jihool3670]

Thanks for the suggestion!

I am able to successfully create a Web V2 connection and I am able to select that connection in both the Web and Webhook activities in a Fabric pipeline.

However, I want to use the Copy Activity rather than the Web activity. When I add a Copy Activity to the canvas, I don't see my newly created V2 web connection as an option in the Source connection drop down, even after refreshing the list of the connections.

Additionally, when I try to create a new connection from within the Copy Acitivity, boththe REST and HTTP connections only have Anonymous and Basic as their authentication options and don't include service principal authentication.

It seems like this is just a current limitation of the Copy Activity at this point in time but I haven't been able to any documentation around current limitations so I'd love confirmation (and ideally a sense of when to expect this functionality).

[Charline_74]

Hi @jihool3670, 

Have you found a solution to your problem, as I have exactly the same problem?

Thanks in Advance, 

Charline

[jihool3670]

Hi Charline - No, not yet. It seems to be a limitation of the copy activity authentication options in Fabric at the moment.

@makromer can you confirm Fabric pipelines can't authenticate to the Fabric/Power BI admin API at this point in time?

[jihool3670]

Yes I should have mentioned that. I have successfully used the service principal to access that specific API using a Spark notebook. I tried the credentials multiple times to make sure it wasn't a copy/paste error when creating the web connection. 

[DennesTorres]

Hi,

I also notice your screenshot of the new connection window doesn't make very clear where the service principal is set on the connection.


Kind Regards,

Dennes

[jihool3670]

Here is the complete screenshot:

[DennesTorres]

Hi,

Maybe I can help a bit with the error message. "why it mentions OAUTH".

The authentication process needs to contact Azure and retrieve an authentication token for the service principal. Once Azure is contacted, this token is presented to the Power BI Admin API you are calling for authentication. Basically, this is an OAUTH authentication/authorization process.

The error message is clear: The service principal permission is denied. It's difficult to say if it's denied on the first step (while authenticating on Azure) or on the 2nd step (while authenticating against the power bi admin). But if I had to guess, it's the 2nd step. Permissions to access the Power BI Admin.

You mentioned you did this access from other places before, such as a notebook. I would double check if the information is all correct, because it's easy to mistype something: The tenantId, the service principal Id and the key.

If you double check it and everything is right, explaining why it works in one place and not in other is a bit more difficult. Maybe if you show both to compare we can come up with something.

Kind Regards,

Dennes

[jihool3670]

Thanks for the detail. I'll post screenshots when I'm at my PC.

Prior to trying with a Fabric pipeline, I was successful in using an ADF copy activity using the same SP. The difference was I was able to specify an AAD resource when creating the linked service. Is that not relevant with Farbic?

https://learn.microsoft.com/en-us/azure/data-factory/connector-rest?tabs=data-factory#use-service-pr...

[DennesTorres]

Hi,

You mentioned you are using a service principal. Did you give the service principal the permissions on power bi to access the API's ?

Kind Regards,

Dennes