401 Unauthorized (ServicePrincipalIsNotAllowedByTenantAdminSwitch) for XMLA Endpoint Automation

Hello Azure & Power BI Community,

I am attempting to automate TMSL tasks (partitioning and refreshes) via the XMLA endpoint using a Service Principal (SPN) in a Python script (MSAL library). While the SPN successfully executes Power BI REST API calls, it fails when targeting the XMLA endpoint.

The Evidence

• Manual Success: I can successfully run TMSL commands (schema changes/refreshes) via SSMS using my personal credentials. This confirms the XMLA endpoint is enabled and set to Read-Write at the capacity level.

SPN Failure: The same tasks fail when run via the Service Principal.

Error Code: 401 Unauthorized

Response Header: X-PowerBI-Error-Info: ServicePrincipalIsNotAllowedByTenantAdminSwitch

Current Configuration

Identity: App (SPN) is registered in Entra ID and is a member of a dedicated Security Group.

Permissions: Both the SPN and its Security Group are Admins in the target Premium Workspace.

Tenant Settings: The setting "Allow service principals to use Power BI APIs" is Enabled for my SPN's Security Group.

Auth: Using MSAL in Python; Client ID, Secret, and Tenant ID are verified (they work for REST API calls).

The Problem

Despite the REST APIs working, the XMLA endpoint returns the ServicePrincipalIsNotAllowedByTenantAdminSwitch error. Copilot suggested adding Dataset.ReadWrite.All as an Application Permission, but only Delegated is available in the portal. However, my understanding is that SPNs rely on Workspace roles and Tenant switches rather than AAD permissions for XMLA access.

My Question

Since the XMLA endpoint is confirmed "Read-Write" and the SPN is enabled for "Power BI APIs," is there a secondary tenant or integration setting required specifically for Service Principals to access the XMLA protocol?

Thank you for any insights! If possible, please attach images showing where to configure extra settings, so I can show my IT team where to look. Thanks again!

[Moved from Microsoft 365 and Office | Other]