ODMPBI | Check source/Target connection failed with unauthorised exception (4378391)

Getting the below error when testing power BI with "Connect to PowerBI". Consent Granted and Account is "Global Administrator"

Error 1

Check source connection failed with unauthorised exception

Error 2

AADSTS500014: The service principal for resource 'https://analysis.windows.net/powerbi/api' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it. Trace ID: xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Correlation ID: 6107835b-xxxx-xxxx-xxxx-xxxxxxxxxxxxTimestamp: YYYY-MM-DD 05:41:38Z

Cause for Error 1

Prerequisites not met / not complete with configuration

Cause for Error 2

The tenant has been disabled with Power BI or the subscription expired.

Resolution for error 1

Permission/Prerequisites that needed to be completed including consent grant and Global Administrator rights (Below summary details). For more details steps kindly refer to our official document with this link. Any miss out of the below will lead to the error.

1) Consent and Permissions

2) Granting additional permissions for the source and target tenants 

2.1) Part 1- Azure Portal Security Group Setup

1. Login to https://portal.azure.com with your tenant credentials.
2. Open the Microsoft Entra ID service page.
3. Click Manage > Groups from the navigation panel. Then click New Group.

   

4. In the New Group page, setup the group as described below:
   1. Group type = Security
   2. Group name = name of the group. For example, ODMPBI
   3. Group description = short description about the group. For example, ODM Power BI Migration.
   4. Under Members, click No members selected
   5. In the Add members list that opens, search and select Quest On Demand - Migration - Power BI. Then click Select at the bottom of the page.

      

   6. Click Create. The group is created with the Quest On Demand - Migration - Power BI service principal as a member.
5. Follow all the above steps to create a security group in both source and target tenants.

2.2) Part 2- Power BI Setup

1. Log into the Power BI service portal at https://app.powerbi.com. with your tenant credentials.
2. Click the Settings icon in the top bar and then click Admin portal.
3. From the navigation panel, click Tenant settings.
4. Scroll down to the Developer Settings section.

4. 1. Expand the Embed content in apps option.
      1. Set the slider to Enabled.
      2. For the Apply to option, select Specific security groups, and specify the group name created in Part 1 above. For example, enter ODMPBI.
      3. Click Apply to save the changes.

         

   2. Under Developer Settings, expand following options. Then enable each option and repeat the above steps to associate the security group:
      • Service principals can create workspaces, connections, and deployment pipelines
      • Service principals can call Fabric public APIs
      • Allow service principals to create and use profiles
5. Scroll down to the Admin API settings section.
6. Expand following options. Then enable each option and repeat the above steps to associate the security group:

• • Service principals can access read-only admin APIs
  • Enhance admin APIs responses with detailed metadata
  • Enhance admin APIs responses with DAX and mashup expressions

    

To migrate Power BI data, the security group must also be granted explicit rights in all tenant Power BI objects like Connections, Gateways and Workspaces.

For Connections and Standard Gateways

1. 1. Click the Settings icon in the top bar and then click Manage connections and gateways.
   2. Under Manage connections and gateways, select each On-premises gateway and give Admin rights to the group, created in Part 1.
   3. Repeat the above steps for source and target tenant.

• For each Workspace that you want to migrate (Source tenant only)
  1. Open the Workspace and click Manage Access.
  2. In the Add people page that opens, add the security group created in part 1 and assign the Admin role to the group.

     

Resolution for error 2

1) Make sure tenant has power BI subscription. and API access "https://analysis.windows.net/powerbi/api"is not restricted /disabled.

2) Make sure tenant is not expired and with subscription enabled.