Question

Why do I get a 401 (unauthorized) error when using a service principal access token to call the Users.GetUserArtifactAccessAsAdmin API in Power BI?

I am trying to use a service principal to call the Users.GetUserArtifactAccessAsAdmin API in Power BI but keep encountering a 401 (Unauthorized) error. The service principal is properly registered in Azure AD, and I have assigned the necessary API permissions, including Tenant.Read.All and Tenant.ReadWrite.All. Additionally, the service principal has been granted Power BI admin permissions. Despite this setup, the request fails with an unauthorized response. Has anyone encountered this issue? What steps can I take to resolve it?

Answer 1

A 401 (Unauthorized) error when using a service principal to call Users.GetUserArtifactAccessAsAdmin in Power BI is usually due to one of the following reasons:

1. Missing Required Permissions: Even though you've assigned Tenant.Read.All and Tenant.ReadWrite.All, ensure they are admin-consented in Azure AD. Also, verify that AuditLog.Read.All and Org.Read.All permissions are granted if needed.

2. Service Principal Not Enabled for Admin APIs: The Allow service principals to use Power BI APIs setting must be enabled in the Power BI Admin Portal under Tenant Settings → Developer settings.

3. Lack of Global Admin or Power BI Service Administrator Role: The service principal must belong to a Power BI Service Administrator, Global Administrator, or an authorized security group allowed to use the Admin API.

If these settings are correct, try refreshing the token and ensure the API request includes the correct access token format with the required scope. Let me know the exact error message for further troubleshooting.