Using a Service Principal for the Activity Events API

[andymc]

Hello,

I have been setting up a proof of concept on accessing Activity Events API using a Service Principal account.  I have worked out most of the issues but am currently getting the error code 401 and haven't been able to pinpoint the registered application setup as well as any permissions that are needed to be added. 

I have followed multiple articles outlining the setup and have hopefully summarized well enough below.  But any feedback would be greatly appreciated.

I have started out with the Daemon Application code from the .Net Core Quick Start Code in the Azure Application Setup.

I am able to get authenticated correctly, using the Client Secret.  I have also confirmed that I can successfully issue my GET against the User.Read API in Microsoft.Graph.

When I switched the resource and call over to Power Bi I am now getting a 401 error.

For the call my resource is: https://analysis.windows.net/powerbi/api/.default

The call I am trying to issue is: 

https://api.powerbi.com/v1.0/myorg/admin/activityevents?startDateTime={startTime}&endDateTime={endTi...

The application permissions setup are

I have setup a Security Group (PowerBiTestSecrurityGroup) in Azure with the Application Service Principal setup as a member.

Lastly I have gone into Power Bi and enabled the Admin API Settings for that security group.

At this point I was really hoping to identify any final adjustments that are needed to execute this call using a Daemon Application.

[mbutler71]

This does actually work. I also removed all of the permissions of a Service Principal I wasn't using and tried to call the Power BI Admin Activity Events API, and it got back the report usage data.

[VSmart]

Remove Tenant.ReadAll and Tenant.ReadWriteAll. It writted in documentation. https://learn.microsoft.com/en-us/rest/api/power-bi/admin/get-activity-events#permissions

And there https://stackoverflow.com/questions/75742033/get-401-error-when-try-to-get-power-bi-activity-events-...  

[v-shex-msft]

HI @andymc,

AFAIK, these logs are pull from audit logs, have you enable this feature before the test?

Track user activities in Power BI - Power BI | Microsoft Docs

In addition, this is one of the admin rest API. it was different from common rest APIs and it requires additional admin permission to use.

For this scenario, I'd like to suggest you check the test account settings to confirm it has enough permissions.

The user must have administrator rights (such as Office 365 Global Administrator or Power BI Service Administrator) to call this API or authenticate via service principal.

Regards,

Xiaoxin Sheng

[andymc · Accepted solution]

After a lot of trial and error I have finally solved the issue.  I am not entirely certain why this is the case but when I remove all references to Power BI API calls from Azure API Permissions setup in the Azure App Registration the call works.