Powerbi-docs: Adding Service Principal as workspace admin via API - Is the REST API syntax correct?

[bcrosnier]

On the REST API syntax page, section example for giving Admin access right to a service principal, it gives the following request and body:

POST https://api.powerbi.com/v1.0/myorg/groups/f089354e-8366-4e18-aea3-4cb4a3a50b48/users
Body:
{
  "identifier": "1f69e798-5852-4fdd-ab01-33bb14b6e934",
  "groupUserAccessRight": "Admin",
  "principalType": "App"
}

Now, I'm trying to grant a SP on my PBI Workspace, so I execute the following with my own workspace ID and SP Object ID:

POST https://api.powerbi.com/v1.0/myorg/groups/<workspace-id>/users
Body:
{
  "identifier": "<aadsp-object-id>",
  "groupUserAccessRight": "Admin",
  "principalType": "App"
}

Unfortunately, I get a 400 Bad Request response back with the following body:

{
    "error": {
        "code": "InvalidRequest",
        "message": "Parameter userDetails.PrincipalType is missing or invalid"
    }
}

Am I being stupid? #672 made it work not three days ago.

Tried tweaking case and content-type - but to no avail.

Cheers,

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: c135bb4c-618b-478d-bce7-ac8608e3caac
• Version Independent ID: a297498b-afa2-575d-417c-0cb4696a90af
• Content: Service principal with Power BI - Power BI
• Content Source: powerbi-docs/developer/embed-service-principal.md
• GitHub Login: @markingmyname
• Microsoft Alias: maghan

[mgblythe]

Thanks for your comment, @bcrosnier. We’ve forwarded your feedback to the writer, who should respond to this thread.

[SenthuranSivananthan]

To add on, I'm getting the following error for POST https://api.powerbi.com/v1.0/myorg/groups/WORKSPACE_ID/users

Payload

{
  "identifier": "OBJECT_ID_OF_SERVICE_PRINCIPAL",
  "groupUserAccessRight": "Admin",
  "principalType": "App"
}

{
    "error": {
        "code": "PowerBIEntityNotFound",
        "pbi.error": {
            "code": "PowerBIEntityNotFound",
            "parameters": {},
            "details": []
        }
    }
}

[aivsim]

Got the same situation here as @bcrosnier and @SenthuranSivananthan. Did anyone managed to progress by solving this problem? Help will be appreciated.

[NielsNauwynck]

@aivsim ,I had the same problem as @bcrosnier where i received "Parameter userDetails.PrincipalType is missing or invalid" while trying to add the service principal as an admin to an existing workspace. Solved it by creating a new workspace using the preview function instead of old fashioned way ( looks like it's added to the documentation now that you need a new workspace created with the preview, or it might have already been there and i'm just blind ). The other thing I did wrong was adding the application itself to the security group under the tab 'Applications' instead of adding the service principal of the application under the tab 'Members'.

Hope this helps anyone with the same problem.

[mgblythe]

Thanks @NielsNauwynck -- appreciate you sharing what you did to get this working.

[markingmyname]

@NielsNauwynck, thank you for your reply.

That is correct, Service Principal only works with workspaces v2.

@bcrosnier, @SenthuranSivananthan, and @aivsim, does this help or further assistance is needed?

[ai-fi-pl]

does this work for anybody? I have a new type workspace with and evry try to set there service principal as an admin fails with 401 or 403, I was able to add a security group, as admin, same as set in tenant settings to enable sp authentication and containing this sp but then I tried all ways rst api powershell etc to authenticate and with even if I can login ( with Powershell) I can't do anything more due to 403 missing permissions. Does anyone have the working end-2-end solution? I use a PowerBi embedded Premium (A4) capacity with that workspace and it's in west europe region is that functionality available in that region?

[SenthuranSivananthan]

@ai-fi-pl I did get it to work. Only admin users can add others so my steps were below. This is only because we can't add Service Principals through the UI yet.

1. Create a Native App registration and login with your own credentials to get an oauth token.

            var authority = "https://login.microsoftonline.com/common";
            var authenticationContext = new AuthenticationContext(authority);

            // Authentication using master user credentials
            var credential = new UserPasswordCredential("[email protected]", "password");
            return authenticationContext.AcquireTokenAsync("https://analysis.windows.net/powerbi/api", nativeAppId, credential).Result.AccessToken;

1. Once you have the access token, use it through Postman to add the Service Principal

HTTP POST https://api.powerbi.com/v1.0/myorg/groups/YOUR WORKSPACE GUID/users
Add the bearer token to the header
Add the following to the body

{
"groupUserAccessRight":"Admin",
"identifier":"xxxxxxxxx-0123-4b40-xxxx-xxxxxxxxxxx", <- object id of the service principal
"principalType":"App"
}

[ai-fi-pl]

@SenthuranSivananthan just one thing if you use a native app then you don't have possibility to add key/password to it.
How you use it to authenticate to Power BI Service?
the workflow I wont to get is to use service principal intead of master account.

[SenthuranSivananthan]

@ai-fi-pl My workflow is to use service principal too. Master account is only being used to add the service principal to the workspace. Once you do that, you can use the service principal to view dashboards/reports/tiles.

The code in step 1 (in my last post) is what I used. Note this line:

            var credential = new UserPasswordCredential("[email protected]", "password");

[ai-fi-pl]

@SenthuranSivananthan thanks for help but still I can't figure out what you use as service principal password as NAtive apps don't have it maybe you ment to create an server-side web application not a native one? Or you can tell me how you added a password to your native app so you are using a app credentials ID and key/password instead of master account.

[SenthuranSivananthan]

@ai-fi-pl , you'll have to use your own email/password OR another user account that has an email address and password. This is the master account flow and it's only so that you can add the service principal to the workspace as an Admin. This is a one time task.

Once this is done, you'll use a Web App (app registration) with app id and app secret to authenticate to PBI as the service principal

            var authority = $"https://login.microsoftonline.com/{tenantId}";
            var authenticationContext = new AuthenticationContext(authority);

            // Authentication using app credentials
            var credential = new ClientCredential(appId, appSecret);
            return authenticationContext.AcquireTokenAsync("https://analysis.windows.net/powerbi/api", credential).Result.AccessToken;

Now, once you have the access token for the service principal, you can interact w/ PBI as the service principal:

            var accessToken = … // above code
            var tokenCredentials = new TokenCredentials(accessToken, "Bearer");

            var pbiClient = new PowerBIClient(new Uri("https://api.powerbi.com/"), tokenCredentials);

            // You need to provide the workspaceId where the dashboard resides.
            ODataResponseListReport reports = pbiClient.Reports.GetReportsInGroup(workspaceId);

            // Get the report by name
            Report report = reports.Value.Where(x => x.Name.Equals("Retail Analysis Sample")).FirstOrDefault();

     …

[ai-fi-pl]

@SenthuranSivananthan it's clear for mewhat is unclearthis workflow works only wih Native type of app
so where do you get/set appSecret variable in below code from your example
var credential = new ClientCredential(appId, appSecret);

as far as I know there is no way to set password/key to native app if you know the way please share it if secret is something different also please let me know :)

[ai-fi-pl]

@SenthuranSivananthan I will write it again :) it's clear for me what you are saying but uncleart is that described workflow works only with Native type of apps and by design such apps don't have a key/password,
so where do you get/set "appSecret" variable that was defined in your code example:
var credential = new ClientCredential(appId, appSecret);
again, as far as I know, there is no way to set password/key to native app if you know the way please share it with me if secret is something different also please let me know :) thanks in advance

[SenthuranSivananthan]

@ai-fi-pl happy to take this offline with you to help. Can you email me at sesivan[at]microsoft.com ?

[LincredibleD]

@SenthuranSivananthan I tried your method and I am getting the following error response when I try to add the service principal to the workspace using Postman:

{"error":{"code":"InvalidRequest","message":"Failed to get service principal details from AAD."}}

Am I missing some configuration?
Thanks.

@ai-fi-pl I did get it to work. Only admin users can add others so my steps were below. This is only because we can't add Service Principals through the UI yet.

1. Create a Native App registration and login with your own credentials to get an oauth token.

            var authority = "https://login.microsoftonline.com/common";
            var authenticationContext = new AuthenticationContext(authority);

            // Authentication using master user credentials
            var credential = new UserPasswordCredential("[email protected]", "password");
            return authenticationContext.AcquireTokenAsync("https://analysis.windows.net/powerbi/api", nativeAppId, credential).Result.AccessToken;

1. Once you have the access token, use it through Postman to add the Service Principal

HTTP POST https://api.powerbi.com/v1.0/myorg/groups/YOUR WORKSPACE GUID/users
Add the bearer token to the header
Add the following to the body

{
"groupUserAccessRight":"Admin",
"identifier":"xxxxxxxxx-0123-4b40-xxxx-xxxxxxxxxxx", <- object id of the service principal
"principalType":"App"
}

[SenthuranSivananthan]

@LincredibleD I also saw this error and it's because I was using the wrong object id.

The correct object id to use: Go to Web App registration -> Service Principal -> Properties -> Object ID

These are the screenshots: https://docs.microsoft.com/en-us/power-bi/developer/embed-service-principal#how-to-get-the-service-principal-object-id

[LincredibleD]

@LincredibleD I also saw this error and it's because I was using the wrong object id.

The correct object id to use: Go to Web App registration -> Service Principal -> Properties -> Object ID

These are the screenshots: https://docs.microsoft.com/en-us/power-bi/developer/embed-service-principal#how-to-get-the-service-principal-object-id

Thank you @SenthuranSivananthan. I had no idea I was using the wrong Object ID the whole time! The link and screenshot you sent helped tremendously!

[ai-fi-pl]

@SenthuranSivananthan and @LincredibleD thanks for answers and great help but still I was able to add SP as an workspace admin but only for a native app and now I just don't get how to use it to authenticate? as by design nativeapps don't havepassword/key. Could you please help me with that?

[bcrosnier]

Okay, I managed to get it right. Thank you all for your answers.

My issue was that I was, indeed, using a non-preview Workspace. Migration is not possible currently, as documented here, so I had to make a new one.

Once you have a preview workspace, you can grant the service principal using the following piece of Powershell.
You need the relevant module, so you might have to execute Install-Module -Name MicrosoftPowerBIMgmt first.

$objectId = 'My-Application-Service-principal-Object-Id'
$groupId = 'My-PowerBI-Group-Id'

Connect-PowerBIServiceAccount
$accessToken = Get-PowerBIAccessToken

# https://docs.microsoft.com/en-us/rest/api/power-bi/groups/addgroupuser
$params = @{
 "identifier"=$objectId;
 "groupUserAccessRight"="Admin";
 "principalType"="App";
}
Invoke-RestMethod -Headers $accessToken -Method POST -Uri "https://api.powerbi.com/v1.0/myorg/groups/$groupId/users" -Body ($params|ConvertTo-Json) -ContentType "application/json"

I didn't have any alternatives to nab a token, since I'm using a tenant that passes through to Okta (meaning I can't use the OAuth password grant).
Hopefully, the Invoke-RestMethod cmdlet won't bite back with an error.

Once this is done, the rest of the integration should be smoother (I say should, because I'm not a PBI admin in my tenant and therefore cannot grant its Security Group in that stupid box in the tenant settings, but it's on our side now).

Thanks a lot to @NielsNauwynck and @markingmyname.

While my issue is resolved, I realize this ticket kind of became support central for PowerBI auth - is it fine to close it ?

[u02cm62]

We found ways to get native apps to have a client secret, but it was a powershell completely seperate from this. However in all the directions, they are saying you have to use the web/ api app, so this means re-registering your web app from native to web/api app type and then it gives you a client secret. They don't tell you this as this was something that was absolutely needed for PBIE before V2 workspaces. But it can be same name as it's a different type of web app. I would just re-register it.

[u02cm62]

Adding your service principal to a security group was the way to get around all the hassles as well with workspaces and in Power BI Admin portal to add it to use the power bi apis.

[markingmyname]

Thank you all for the collaborative feedback.

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion, and we will reopen the issue.