How do I get execute permissions on a Fabric Workload Item?

[q-benwillis]

When I create a new workload item and call the resolve permissions endpoint I only have "Read", "Write" and "Reshare" permissions. How can I also get the execute permission?

[michal-mano]

Hello,
Can you try adding the "Power BI Service Item.Execute.All" delegated permission to your Entra ID App?

After adding this, you'll have to provide consent as the user for this additional permission.

[q-benwillis]

It's not that I want my entra id app to have the execute permission, it's that I would have though the user should have execute permission on fabric workload items that they create.

There's an example here in the sample repo of using the resolve permissions endpoint to check the user has the right permissions to carry out an action:

Microsoft-Fabric-workload-development-sample/Backend/src/Services/AuthorizationHandler.cs

Lines 37 to 60 in b4cd86d

	public async Task ValidatePermissions(AuthorizationContext authorizationContext, Guid workspaceObjectId, Guid itemObjectId, IList<string> requiredPermissions)
	{
	// For calling Fabric workload-control APIs we need a SubjectAndApp token with Fabric audience
	var subjectAndAppToken = await _authenticationService.BuildCompositeToken(authorizationContext, FabricScopes);
	// Resolve item permissions using the provided token
	var response = await ResolveItemPermissions(subjectAndAppToken, workspaceObjectId, itemObjectId);
	Ensure.NotNull(response?.Permissions, "Fabric response should contain permissions");
	// Check if any of the required permissions is missing
	if (requiredPermissions.Except(response.Permissions, StringComparer.OrdinalIgnoreCase).Any())
	{
	_logger.LogError(
	"Insufficient permissions: subjectTenantObjectId={0}, subjectObjectId={1}, workspaceObjectId={2}, itemObjectId={3}, requiredPermissions=[{4}], actualPermissions=[{5}]",
	authorizationContext.TenantObjectId,
	authorizationContext.ObjectId, // NOTE: ObjectId is EUPI and requries special handling
	workspaceObjectId,
	itemObjectId,
	requiredPermissions,
	response.Permissions);
	throw new UnauthorizedException();
	}
	}

Ideally I want to check the user has the "execute" permission but I don't know if they can actually get that permission?

[michal-mano]

Okay, understood, thanks for clarifying.
We do not yet support custom permissions such as Execute. All items are generated with just Read, Write, Reshare