Since the Februari 2026 update of ArcGIS Online, using gis.admin is no longer possible using an API key in ArcGIS Online if you set individual privileges. If you create an API key the impersonates an admin user it works. This used to work before the update.This severely reduces security for automation of admin tasks.
The issue
As an administrator I want to automate certain tasks and checks using the ArcGIS API for Python. I want to use API keys to do this (or app auth, but I suspect I run into the same problem). I want to give this API key minimal privilege: only assign the privileges it needs to fulfull the tasks automated. Before, I could use an API key using the option "Private application with selected privileges and access", no item access, and assign the admin privilege "Manage licenses" to get licenses used by all users using arcgis.gis.admin.LicenseManager. Since the last update, this gives error: "gis has no module admin". I now have to use "Private application that impersonates you" to create an aAPI key that allows me to use gis.admin. Eventhough the script only needs "view all users" and "Manage licenses", I now have to create an API key with FULL ADMINISTRATOR ACCESS! This API key, when compromised, can be used to delete all users, all content, update organization settings etc. This is not acceptable for a security point of view.
Proposed solution
Honour API key privileges also in the ArcGIS API for Python. Allow assigning individual administrator privileges to API keys (as is now suggested, but not working)
