Especially in this time of the year, you will encounter many similar kind of questions as a Power BI Service Administrator. Questions like: “My colleague is on vacation, but I don’t have access to the workspace and the refresh broke, can you help me getting access to this workspace?” Well, this is still the simple one, as you can easily add users to a workspace from the Power BI Admin portal. But what about Power BI deployment pipelines? There is no interface available in the admin portal where you can easily get an overview of all deployment pipelines in your tenant, not yet even talking about granting someone else access to a deployment pipeline.
In this blog I will elaborate on the challenge we encounter here and how you can deal with this situation by taking advantage of the Power BI REST APIs and using a small and simple PowerShell script.
The challenge we try to solve
It is August when I’m writing this blog, summer vacation season. Many people are out of office and did their best to hand-over their responsibilities to their replacements during their absence. However, something we might forget something and that is exactly what happened this morning.
At one of the clients I work for, we encountered a situation at a client, where we an existing deployment pipeline in Power BI was used to distribute content from the development workspace to test and finally production. However, the person who once setup this deployment pipeline, did not grant access to anyone else in the team. As we have to release a new version of our reports to production, we prefer to do this via the deployment pipeline of course! However, we couldn’t since we cannot use the pipeline without permissions.
Alternatively, we could have released our Power BI desktop files directly to the Production workspace, but since we did not have sufficient permissions to this production workspace, we couldn’t proceed this way. These limited permissions on production are set intentionally, as we have a best practice to only do meta data releases using the deployment pipeline and not to overwrite the existing dataset and reports from Power BI Desktop.
So, what now? Cause granting access to a Power BI Workspace is fairly easy from a Power BI Service administrator perspective. There is a nice interface where we can search for existing workspaces and update workspace permissions. However, there is no such interface for Power BI Deployment Pipelines.
Second alternative was spinning up an entirely new deployment pipeline and trying to assign the existing workspaces to this new deployment pipeline. However, as the workspace is already assigned to another deployment pipeline, we would have run into a roadblock pretty quickly. Therefore we decided to proceed this way and trying to figure out something else.
The solution
REST APIs to the rescue! Luckily there are some Power BI REST APIs which allow us to list all existing Power BI Deployment Pipelines in the current tenant and update permissions for these pipelines. All these REST APIs require to be executed by the Power BI Service Administrator. So, the very first thing you need to do, is reach out to your admin and ask them for help!
List all deployment pipelines in the tenant
With the first API, we can at least find the deployment pipeline where we’re lacking the permissions to. The Pipelines GetPipelinesAsAdmin REST API, we get the following response that will give us very minor but the required information to proceed.
GET https://api.powerbi.com/v1.0/myorg/admin/pipelines{
"value": [
{
"id": "a5ded933-57b7-41f4-b072-ed4c1f9d5824",
"displayName": "Marketing Deployment Pipeline",
"description": "Power BI deployment pipeline to manage marketing reports"
},
{
"id": "183dcf10-47b8-48c4-84aa-f0bf9d5f8fcf",
"displayName": "Financing Deployment Pipeline",
"description": "Power BI deployment pipeline to manage financing reports"
}
]
}The displayName helps us to find the deployment pipeline we are looking for. The next thing we need here, is the id of this pipeline which we need as an input for the next API.
Update permissions for the pipeline
The next REST API helps us to add a user or even a security group to the existing deployment pipeline. Depending on whether you want to add a group or individual user, you need to specify a different request body in the Pipelines UpdateUserAsAdmin REST API. Below example is based on a named user. Other examples are detailed out in the documentation.
POST https://api.powerbi.com/v1.0/myorg/admin/pipelines/{pipelineId}/users{
"identifier": "{specify user mail address here}",
"accessRight": "Admin",
"principalType": "User"
}Make sure you specify the pipeline id in the POST command. Also fill in the mail address of the user that you want to get added to the deployment pipeline in the request body.
Wrap up
Let me start with pointing out that there is simply a missing overview in the Power BI Admin portal. An overview for deployment pipelines, just like the workspace overview is missing but heavily required as Power BI tenant administrator.
Using the REST API to list all deployment pipelines and the API to update user permissions, helped us to get our team members added to the Power BI deployment pipeline. Now they could successfully release the reports to the production workspace using the intended process as we have set it up.
As calling the Power BI REST APIs is not as easy as it is for everyone, I decided to share the script I created. You can find it in my GitHub repository for Power BI Automation where I shared the PowerShell script I used to execute these two operations. By executing the PowerBI_AssignUserToDeploymentPipeline.ps1 script, it will loop you through all the steps to do and asks for your input parameters.
Data - Marc 