Dealing with orphanated deployment pipelines

Someone on my team was trying to delete a Power BI workspace but couldn’t. It said there was some deployment pipeline associated that prevented that action. The tricky part was that no one could see any pipeline.

This lead me down the rabbit hole to find, that, if an account would be deleted from the active directory, and that same account was the only user of a pipeline that pipeline would turn an orphan. Invisible from everyone

The script down below is a way for you to find them in your tenant and act on them, either adding a new owner or deleting them.

from http import client
import requests
from requests.structures import CaseInsensitiveDict
from azure.identity import ClientSecretCredential
from configparser import ConfigParser
from pprint import pprint

## login using service principal credentials from a file
config = ConfigParser()
config.read('config.ini')

client_id = config["Credentials"]["client_id"]

credentials = ClientSecretCredential(
    tenant_id=config["Credentials"]["tenant_id"],
    client_id=client_id,
    client_secret=config["Credentials"]["client_secret"],
    authority="https://login.microsoftonline.com/"
)
access_token = credentials.get_token("https://analysis.windows.net/powerbi/api/.default")

# ## Top get 100 from all pipelines use:
# url = "https://api.powerbi.com/v1.0/myorg/admin/pipelines?$expand=users,stages&top=100"
# ## Get the orphanated pipelines, limiting to top 100
# ## https://docs.microsoft.com/en-us/rest/api/power-bi/admin/pipelines-get-pipelines-as-admin#get-orphaned-deployment-pipelines-example
url = "https://api.powerbi.com/v1.0/myorg/admin/pipelines?$expand=users,stages&$filter=(not users/any())&$top=100"

headers = CaseInsensitiveDict()
headers["Accept"] = "application/json"
headers["Authorization"] = f"Bearer {access_token.token}"

resp = requests.get(url, headers=headers)
pipelines = resp.json()

Now that we have the pipelines we can just add a user to them and inspect them like so:

#https://docs.microsoft.com/en-us/rest/api/power-bi/admin/pipelines-update-user-as-admin#add-a-user-to-a-deployment-pipeline-example
data = {
  "identifier": "john@contoso.com",
  "accessRight": "Admin",
  "principalType": "User"
}

act_url = "https://api.powerbi.com/v1.0/myorg/admin/pipelines/"

for pipeline in pipelines['value']:
    req = requests.post(
        url=f"{act_url}{pipeline['id']}/users",
        json=data,
        headers=act_headers)
    pprint(req.status_code)
    pprint(req.content)

Or just delete them:

# https://docs.microsoft.com/en-us/rest/api/power-bi/pipelines/delete-pipeline
act_url = "https://api.powerbi.com/v1.0/myorg/admin/pipelines/"

for pipeline in pipelines['value']:
    req = requests.delete(
        url=f"{act_url}{pipeline['id']}",
        headers=act_headers)
    pprint(req.status_code)
    pprint(req.content)

Have fun!

 Share!