Power BI Ingestion Returns 401 Unauthorized When Admin-Consent Power BI Permissions Are Present on the App Registration – DataHub Customer Support Portal

Area: Ingestion Issues

Sub-Area: Power BI Source Configuration / Azure AD App Registration

Issue

When configuring the DataHub Power BI ingestion source with admin_apis_only: true, the admin scanner API (POST /v1.0/myorg/admin/workspaces/getInfo) returns a 401 Unauthorized error, resulting in 0 workspaces and 0 metadata being ingested. The OAuth token itself generates successfully, and all Power BI tenant settings appear correctly configured — the service principal is a member of the approved security group, and all required admin API tenant settings are enabled. The root cause is a non-obvious Microsoft restriction: if the Azure AD app registration has any admin-consent-required Power BI Service API permissions (such as Tenant.Read.All with Application or Delegated type), Microsoft will reject calls to the read-only admin APIs with 401, even when all tenant settings and security group memberships are correctly in place. This same 401 also explains why admin_apis_only: false fails to return dataset tables, columns, and schema — the connector still calls the admin scanner API internally to retrieve dataset schema regardless of this setting, and that call is rejected the same way.

Error Messages

401 Unauthorized — returned by https://api.powerbi.com/v1.0/myorg/admin/workspaces/getInfo
Unable to fetch get scan result
does not have access to the PowerBI Admin API

You Might Be Asking

Why does my Power BI token generate successfully but the admin endpoint still returns 401?
Why does admin_apis_only: false return reports and pages but no dataset tables or columns?
I have Tenant.Read.All granted with admin consent — shouldn't that give me more access, not less?
All Power BI tenant settings are enabled and the service principal is in the security group — why is the scanner API still rejecting requests?
Do I need any API permissions on the app registration for the Power BI admin APIs to work?

Solution

The fix is entirely on the Azure AD app registration. Microsoft's rule for service principals calling the Power BI read-only admin APIs is: the app registration must not have any admin-consent-required Power BI Service permissions. Access to the admin APIs is granted exclusively through Power BI tenant settings and security group membership — not through API permissions on the app registration.

Open your app registration in the Azure / Entra portal.
Navigate to Azure Active Directory → App registrations → [your DataHub Power BI connector app] → API permissions.
Identify and remove all admin-consent-required Power BI Service permissions.
Look for any row where the API is Power BI Service and the Admin consent required column shows Yes. Common offenders include:
- Tenant.Read.All — Type: Application
- Tenant.Read.All — Type: Delegated
Delete all rows where Admin consent required is Yes, regardless of whether the type is Application or Delegated. The Delegated variant is not exercised by the connector (delegated permissions only apply when a user is interactively signed in), but it still satisfies the condition that triggers the 401 and should be removed as well.
Retain the non-admin-consent Power BI Service permissions.
The following permissions show Admin consent required: No and should be left in place — they are used by the non-admin public APIs and do not interfere with admin scanner access:
- Dashboard.Read.All
- Dataset.Read.All
- Report.Read.All
- Workspace.Read.All
Note: No API permissions need to be added. Admin scanner access requires zero API permissions on the app registration. It is granted solely by the Power BI tenant settings and security group membership described below.
Verify the Power BI tenant settings are correctly configured.
In the Power BI Admin portal, confirm all of the following settings are enabled and scoped to the security group that contains your service principal:
- Allow service principals to use Power BI APIs
- Service principals can access read-only admin APIs
- Enhance admin APIs responses with detailed metadata
- Enhance admin APIs responses with DAX and mashup expressions
Confirm the security group type is "Security", not "Microsoft 365".
In the Entra portal, open the security group that is configured in the Power BI tenant settings above. Its Group type must be Security. Microsoft 365 (Office) groups are silently ignored by Power BI admin tenant settings — the settings appear configured correctly in the Power BI Admin portal but the service principal does not receive access. If the group is an M365 group, create a new Azure AD Security group, add the service principal to it, and update the Power BI tenant settings to reference the new group.

Wait approximately 15 minutes for permission changes to propagate, then re-run ingestion.

Use the following configuration with admin_apis_only: true:

source:
  type: powerbi
  config:
    stateful_ingestion:
      enabled: true
    tenant_id: '${TENANT_ID}'
    client_id: '${CLIENT_ID}'
    client_secret: '${CLIENT_SECRET}'
    admin_apis_only: true
    extract_dataset_schema: true
    extract_independent_datasets: true
    extract_lineage: true
    extract_column_level_lineage: true
    extract_ownership: true
    extract_endorsements_to_tags: true

Additional Notes

Why the token succeeds but the API call fails: The OAuth token is issued against the scope https://analysis.windows.net/powerbi/api/.default and will generate successfully regardless of which permissions are on the app registration. The 401 is not an authentication failure — it is Microsoft's authorization check on the admin endpoint itself, which rejects any service principal whose app registration carries admin-consent Power BI permissions.

Why dataset schema is missing even with admin_apis_only: false: Dataset tables, columns, and schema are only available through the admin scanner API (/v1.0/myorg/admin/workspaces/getInfo). When admin_apis_only: false, the connector still calls the scanner internally to retrieve dataset schema. If that call is rejected, the connector silently falls back to the public APIs, which return reports and pages but no dataset-level metadata. Fixing the 401 resolves both modes.

Propagation time: Microsoft states approximately 15 minutes for permission and tenant setting changes to take effect; in practice, propagation can occasionally take longer.

Scope of change: This resolution involves only the Azure AD app registration and Power BI tenant settings. No changes to the DataHub ingestion recipe, DataHub infrastructure, or secrets are required beyond ensuring credentials are correctly referenced.

Issue

Error Messages

You Might Be Asking

Solution

Additional Notes

Related Documentation