Get 401 Error when try to Get Activity Events (Audit Logs)

[VSmart]

I'm trying to get Power BI audit logs using service principal.

I follow every step in creating Azure principal Embed Power BI content in an embedded analytics application with service principal and an applicatio...

1.Create app

2.Create secret 

3. Add app into group 

4. Give all permitions to app 

Tenant.Read.All, Tenant.ReadWrite.All;Report.ReadWrite.All, Report.Read.All, Dataset.Read.All;Auditlog.Read.All; Workspace.Read.All;Workspace.ReadWrite.All; and many other permitions.

5. Enable "Allow service principal to use Power BI API's" and "Enable content in apps" in Power BI admin portal.

I can get acces token and run few API calls like : 

"https://api.powerbi.com/v1.0/myorg/groups" and 

"https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports"

But when try to get activity events

"https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='2023-02-13T07:55:00.000Z'&end..." and 

"https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='" + activityDate + "T00:00:00'&endDateTime='" + activityDate + "T23:59:59'"

- get 401 error.

Or post this request "https://api.powerbi.com/v1.0/myorg/datasets/{datasetId}/refreshes" get 403 error.

My Python script is follow:

TENANT_ID = '1eb27ef3-976f-4600-a791-*******'
CLIENT_ID = 'd5376b05-a655-463b-ae9f-*******'
CLIENT_SECRET = '**************************'
SCOPE_BASE = ['https://analysis.windows.net/powerbi/api/.default']
AUTHORITY_URL = 'https://login.microsoftonline.com/organizations'
try:
    authority = AUTHORITY_URL.replace('organizations', TENANT_ID)
    clientapp = msal.ConfidentialClientApplication(CLIENT_ID, client_credential=CLIENT_SECRET, authority=authority)
    response = clientapp.acquire_token_for_client(scopes=SCOPE_BASE)
    try:
        access_token = response['access_token']
        activityDate = date.today() - timedelta(days=1)
        activityDate = activityDate.strftime("%Y-%m-%d")

        url = "https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime='" + activityDate + "T00:00:00'&endDateTime='" + activityDate + "T23:59:59'"
        header = {'Content-Type':'application/json', 'Authorization':f'Bearer {access_token}'}
        api_call = requests.get(url=url, headers=header)
        print(api_call)
        print(api_call.json())

    except KeyError:
        raise Exception(response['error_description'])

except Exception as ex:
    raise Exception('Error retrieving Access token\n' + str(ex))

[v-shex-msft]

Hi @VSmart,

Perhaps you can take a look at the following link that mentions about the similar issues:

Solved: Using a Service Principal for the Activity Events ... - Microsoft Power BI Community

Regards,

Xiaoxin Sheng

[VSmart]

Thank you error disappear when i remove Tenant.ReadAll and Tenant.ReadWriteAll. It writted in documentation. https://learn.microsoft.com/en-us/rest/api/power-bi/admin/get-activity-events#permissions

[v-shex-msft]

HI @VSmart,

I'm glad to hear you find the root causing and share the resolution here, they will help others who faced the similar issues.
Regards,

Xiaoxin Sheng