Service Principal support for read-only Admin APIs - Documentation issues

[DebbieE]

Im attempting to look into the September 2021 Update -Service Principal support for read-only Admin APIs and have hit lots of issues with the documentation that I want to iron out. 

"Service principal is an authentication method that can be used to let an Azure AD application access Power BI APIs"

I followed the documentation https://powerbi.microsoft.com/en-us/blog/power-bi-september-2021-feature-summary/#post-17174-_Toc819...

And got to 1. Create an Azure AD app.

and for this you have to go to another document https://docs.microsoft.com/en-gb/power-bi/admin/read-only-apis-service-principal-authentication

A1. create Azure AD App (All OK)

2. Assign Role (I have assigned Contributor but it doesnt specifically tell you what role you need)

3. Get Tenant and AppID (Issue here, The documentation says for both, get them from the app from (1)  and Store in your Application Code. I have no idea what that means for this use care?  So I am stuck here. Where do I add tenant and AppID?

4. Create Application Secret (All OK)

5. Configure Access Policies on Resources (I have a Key vault. so i have added the service Principal of the app here with Get and List on secrets)

And thats all it says here, You dont do anything else with the app which is strange because in the blurb it says 'You only need to give your approval once' But there is nothing in the documentation that sets this out.

Then its back to the top level documentation

B1 Create Security Group in azure AD  (everything OK)

2 Add App ID as a member to the security Group (All OK)

3 Enable Power BI service Admin Settings (Security Group added to the correct setting in Power BI)

4. Start using read only admin APIs? This is the real problem here. How do you start using Admin API's its way to vague. Shouldnt there be follow on documentation that explains exactly how you use these APIs with the Service Principal

So this is really questions about holes in the documentation. If anyone could fill these gaps in I would be really appreciative because I am completely blocked on this

[Anonymous]

I have set up every thing according to this:  https://docs.microsoft.com/en-us/power-bi/admin/read-only-apis-service-principal-authentication

I have security group and app registration created, along with security group added to Power BI setting 

Allow service principals to use read-only Power BI admin APIsWhat do use to get access token or how do I call the Power BI Admin APIs?   

[lbendlin]

"start using APIs"  - how would you like to call them?  From Powershell? Power Automate? Power BI ?

[DebbieE]

thats already good information. can you call them from Data Factory? 

[v-rzhou-msft · Accepted solution]

Hi @DebbieE 

Service principal is an authentication method that can be used to let an Azure AD application access Power BI API. You can use Service Principal to get access token from Power BI. Then use this access token to authenticate to get data from Power BI Rest API.

Here is a blog about how to get token by postman by Password. If you want to use Service principal, change Password to Credential and update parameters (Client_Secret and Tenant_ID)in other body.

For reference: get token by postman.

Then you can succeed to connect to Rest API by access token.

Here is the Rest API this function supports.

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[lbendlin]

No idea. The Googol says:  How to use Power BI REST API's in Azure Data Factory - Stack Overflow