Adding service principal directly to the workspace as an admin gives me an error

[Anonymous]

Hi!

I am trying to add Service Principal (app registration) to workspace users. 

I am using AccessToken generated for PowerBI Service principals with granted permission: 

Here is a PowerShell code which I use to add Service Princpal to worksapce users

$Uri = "https://api.powerbi.com/v1.0/myorg/groups/$WorkspaceId/users"

$Headers = @{Authorization = "Bearer $AccessToken"}

$Body = @{

    identifier = $AdObjectIdentifier

    groupUserAccessRight ="Admin"

    principalType = "App"

}

Invoke-RestMethod -Uri $Uri -Headers $Headers -Method Post -ContentType "application/json" -Body (ConvertTo-Json $Body)  

$AdObjectIdentifier is an Azure ObejctId for App Registarion that I want to add to the worksapce users 

I am geting  an error: 

The remote server returned an error: (403) Forbidden.

{"error":{"code":"InvalidRequest","message":"Failed to get service principal details from AAD."}}

I can add AAD group to workspace (when $AdObjectIdentifier = AAD Obejct ID), but not Service principal, why? 

Please, help me to understand this. 

Thanks, 

Urszula

[v-rzhou-msft]

Hi @Anonymous ,

Note:

Service principals have access to any tenant settings they're enabled for. Depending on your admin settings, this includes specific security groups or the entire organization.

Please check whether you have added your Security Group which has added the service principal as a member into the tenant setting.

You may check the steps in the offical blog to learn more details.

For referencce: Embed Power BI content with service principal and an application secret

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

@v-rzhou-msft  I have checked, group (service princiapl which I wanted to add belongs to this group) are added below developers seetings. Sitll I am getting thsi error. Do you have any advise?

[lbendlin]

Your tenant admin may need to allow Service Principals to be used in the tenant.

[Anonymous]

@lbendlin Could you please explain me this a bit more? 

[lbendlin]

talk to your tenant admin about the settings on your tenant.