PowerBI Client does not work with Azure AD service principals

Question

I am trying to get data from PowerBI APIs (using Microsoft.PowerBI.Api.V2 client dlls). Below is my code:

private static async Task getEmbedTokens(string accessToken)
        {
            var tokenCredentials = new TokenCredentials(accessToken, "Bearer");
            var client = new PowerBIClient(new Uri("https://api.powerbi.com/"), tokenCredentials);
            var reports = await client.Reports.GetReportsInGroupAsync("<groupid here>");
            // Get the first report in the group.
            var report = reports.Value.FirstOrDefault();
            if (report != null)
            {
                var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: "view");
                var tokenResponse = await client.Reports.GenerateTokenInGroupAsync("<group id here>", "<report id here>", generateTokenRequestParameters);
                if (tokenResponse != null)
                {
                    // Generate Embed Configuration.
                    var embedConfig = new EmbedConfig()
                    {
                        EmbedToken = tokenResponse,
                        EmbedUrl = report.EmbedUrl,
                        Id = report.Id
                    };
                }

            }
        }

Now I use ADAL to generate bearer tokens and I have tried below 2 scenarios:

Scenario 1: Use UserCredentials (Service account) to generate bearer tokens

HereI am using service account to generate bearer tokens. The service account has access to the powerbi dashboard.

var credential = new UserPasswordCredential("[email protected]", "password");

Scenario 2: Use ClientCredentials (Service principal) to get bearer tokens

Here I am using client id , client secret of a service principal. The service principal has been granted all permissions for Power BI APIs in Azure AD app registration panel.

var clientCred = new ClientCredential(clientId, clientSecret);

Scenario 1 works fine, but scenario 2 I get unauthorized error. I have tried to check if there is any way to give the principal access to dashboard thru power bi portal, but could not find any. I prefer to use service principal, but is it possible to use service principal?

I think you need to click the Grant Permissions button as well (top of the permissions blade for your Azure AD app). — evilSnobu
Grant permissions button was clicked after permissions was selected — Unnie
Scratch that. It's not gonna work. That user has a Power BI assigned license that's why its access token can be successfully exchanged for a Power BI token. ClientId and ClientSecret carry no user context and will not work. — evilSnobu
Correct @evilSnobu - scenario2 will work only for authorization_code flow where you have an authorization code + clientid/secret for the azure ad app in the case of powerbi. — Sat Thiru

Mahir Diab Mahir Diab · Accepted Answer · 2018-05-16T13:15:08

0

votes

currently Power BI doesn't support Service principal / app only tokens.

PowerBI Client does not work with Azure AD service principals

1 Answers