How to create a Power BI workspace using HTTP Action with Multifactor authentication?

[dave8]

Hello,

I am using HTTP action in order to create a Power BI workspace via cloud flow as follows, while account under which this flow is running is having multifactor authentication enabled.

Above setting throws following error:

Action 'HTTP' failed

and status code : 403

Can you help to resolve this? what value I should specify in authentication? Do i require specific configuration for the multifactor authentication? 

Looking forward to hearing from you soon!

Thanks,

[Expiscornovus · Accepted solution]

Hi @dave8,

I would register an app in Azure AD.

https://docs.microsoft.com/en-us/power-bi/developer/embedded/register-app

Assign the permissions (Workspace.ReadWrite.All) for the group creation to that app

https://docs.microsoft.com/en-us/rest/api/power-bi/groups/creategroup

After that you can use the client id, tenant id and secret in your HTTP action by using the Active Directory OAuth authentication. Below example is using https://graph.microsoft.com for the audience value. For your Power BI API this value will be different.

https://www.lee-ford.co.uk/using-flow-with-graph-api/

Small update: in this approach it is also required to update the developer settings in Power BI to allow service principals to use Power BI APIs:

https://powerbi.microsoft.com/en-us/blog/use-power-bi-api-with-service-principal-preview/

[Expiscornovus]

The setup of the HTTP could be something like below.

The created workspace will end up in the Workspaces overview in the Admin Portal section since I haven't assigned any permissions yet.

[dave8]

Hi @Expiscornovus 

I have created an app with all  workspace/group/capacity permissions by adding Power BI Service and created the app secret in Azure AD, however HTTP Action is still failing in the flow. Also it takes longer to execute and finally throws following error:

I have made sure that service principal is enabled at org level and app is having all required permission + secret ID which I have configured as follows:

Do I miss anything else here?

Thanks,

[Expiscornovus]

Hi @dave8,

Looks like your setup should be good to go.

Can you try and append the ?workspaceV2=true to the Uri of your HTTP Post request to see if the v2 Workspace does work?

[dave8]

Thank you @Expiscornovus  for your response,

I have updated the API as suggested, however it again took longer to execute about 12 minutes and has thrown following error:

Not sure what's wrong here! 😐 

I have created secret here, and that's exactly I have specified in the HTTP action:

also, when I try from the API from the "Try it" as mentioned in the doc - with same credentials, workspace is created, however in HTTP action, something is wrong - Any help will be much appreciated!

Regards,

[Expiscornovus]

Hi @dave8,

Just to double check. Does the Client Id match the Application (Client) ID and the Tenant Id match the Directory (tenant) ID of your Power BI REST API app registration in Azure AD in your HTTP action?

And you have also assigned and granted permissions to that app registration, correct?

[dave8]

Unfortunately, I have checked that couple of times to verify and it's exactly the same as you have suggested for client ID/permissions/secret. Also recreated the client secret again to re-verify, however no luck yet.

I have raised support ticket on that, it seems something could be wrong in my environment/configuration somewhere.

I will update here as soon as this is figured out - Thank you again for your willingness to help!

Best,

[dave8]

Hi @Expiscornovus 

While I am waiting for the Microsoft response, I was wondering if this settings are working out for you? were you able to create a workspace successfully via flow? OR Do you think it requires custom connector to be created in order to use it in the flow?

Thank you in advance!

Thanks,

[Expiscornovus]

Hi @dave8,

Yes I am able to create V2 workspaces via a flow. That workspace with the name 'Power BI Workspace V2' from one of my earlier screenshots in the Admin Portal section was actually created via that flow 🙂

Btw, are you able to reproduce the same with a Post request via Postman?

[dave8]

Lucky you!!! I will make sure I accept your approach as solution as soon as I finish with my concern, I am not sure what's wrong at my end yet 😞

I have not tried the postman, but from the Microsoft docs, there is a "Try it" approach, that does work as expected with the same account!

Currently, Microsoft Support has suggested to go with "Access Token" and pass that in the headers as described here - How to Authenticate and Use the Power BI API inside Power Automate - Carl de Souza

This did not work out too, I am not sure yet what's wrong - this is annoying!! 😞

Do you think anything I might miss in app registration? although I have followed the same process.

Best,

[dave8]

Wohhhhh, Finally I FOUND my ROOT CAUSE!!

Actually, There are two types of "API Settings" - Developer API and Admin API in Power BI Admin center, in my case, I had only Admin API enabled which was not enough.

Also "Create New Workspace" should be enabled as well.

Awesome, This is done and dusted! Thank you for your time and help 🙂

Best

[Expiscornovus]

Hi @dave8,

I wasn't aware either that there was also a separate setting for Admin API. Great to hear that it works for you now! 🙂

[dave8]

Hi @Expiscornovus 

Another important step with this is, if only specific AD group is assigned to access Power BI API instead of whole org users, then add registered app as a member in the same AD group as service principal otherwise it throws "unauthorized" error in HTTP action - which is what I was facing in other tenant.

I am unsure if this step is documented anywhere in Power BI/App registration process.

Thanks,