Forum Discussion
App only authentication - oAuth2 token request
Hi ricus_zero you can use the below query in postman, basically you should use the grant type as client_credentials
resource:https://analysis.windows.net/powerbi/api
client_id:xxxxx
client_secret:xxxx
grant_type:client_credentials
Hi ricus_zero
As per microsoft they used v1. So It's a standard for us to use V1 whenever we login using microsoft.
Coming back to your error..
Actually you are calling a API https://api.powerbi.com/v1.0/myorg/reports which is My Workspace This is the default workspace given to your account by PowerBI.
SPN won't able to access My Workspace, because you can only able to access it, not a service account/SPN.
What you can do now ?
- Create a new workspace
- Add the SPN as the Admin to the new workspace
- Publish the report in that workspace
- Call the REST API GET https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId} which the SPN token
Hi Jayendran
Once again coming in with the rock solid response.
Now that you mention it that makes a lot of sense, so in essence, we would require a pro account because only pro accounts can create new workspaces?
For the time being, I've enabled the trial pro account to test this out.
I created a new workspace, when it comes to assigning the service principle as admin to the new workspace, It's not picking it up in the auto complete? Is this feature available on the gui yet? (I remember from a video I watched, that a few months back this wasn't possible from the interface and the SPN had to be added via PowerShell)
For reference, I have a group called Power BI Apps, which has been added under tenant settings:
In Azure AD when I navigate to this group and click on members, I can see the service principle there
When attempting to add this it's not picked up, is this because it's not possible from the gui?
Regards
Hi ricus_zero
Even SPN can able to create new workspace (V2). If you refered the difference between pro and SPN . you can find that solution.
There are 2 types of workspaces
- Classical (v1)
- Upgraded (v2)
PRO have access to both workspace, but SPN should have only v2 workspace. So if you are trying to add your your SPN in V1 workspace it won't work/ show.
You can add the SPN only in the V2 (Upgraded workspace) (from GUI)
Pls see the below screenshot I can able to search the app id in my V2 workspace
Hi Jayendran
Sorry for all the questions, your help has been tremendous so far!
Am I correct in saying that it's possible for a normal license to create new workspaces via the service principle? (API call)
I attempted to create a new workspace via the REST API, making a call to the groups endpoint which got a 403 initially, I tried my luck and added the required scope to the access token call, and magic happened, I could now create a new workspace via the api, and then I assigned this workspace to my PowerBI user so that they can view it as well.
I added some of the sample dashboards and reports to this new workspace that was created via the api
So moving on from that, I then attempted to get the dashboard with the get dashboard endpoint, and got that "API is not accessible for application" response again.
I then had a look at the Embed Token documentation since it's relevant to the App owns data scenario which if I'm not mistaken is what we are dealing with here.
I attempted to get an embed token for said dashboard. I once again had to change the scopes defined when getting the oauth access token, but after that I was able to get a proper response which includes the token / tokenId / expirtation and @odata.context
Now a seemingly simple question of, how do I actually use this embed token in our web app to display the embedded dashboard?
Hope you can help with this
Thanks
Hi ricus_zero
Am I correct in saying that it's possible for a normal license to create new workspaces via the service principle? (API call)
Yes you are correct
You shouldn't use get dashboard API using SPN token Instead use get dashboard in group
Now a seemingly simple question of, how do I actually use this embed token in our web app to display the embedded dashboard?
You can use SDK's See App owns data in dotnet
Basically you need to pass the embed token to PowerBI Javascript
<script> // Read embed application token from Model var accessToken = "@Model.EmbedToken.Token"; // Read embed URL from Model var embedUrl = "@Html.Raw(Model.EmbedUrl)"; // Read dashboard Id from Model var embedDashboardId = "@Model.Id"; // Get models. models contains enums that can be used. var models = window['powerbi-client'].models; // Embed configuration used to describe the what and how to embed. // This object is used when calling powerbi.embed. // This also includes settings and options such as filters. // You can find more information at https://github.com/Microsoft/PowerBI-JavaScript/wiki/Embed-Configuration-Details. var config = { type: 'dashboard', tokenType: models.TokenType.Embed, accessToken: accessToken, embedUrl: embedUrl, id: embedDashboardId }; // Get a reference to the embedded dashboard HTML element var dashboardContainer = $('#dashboardContainer')[0]; // Embed the dashboard and display it within the div container. var dashboard = powerbi.embed(dashboardContainer, config); </script>BTW you can give Like/give kudo's to my replies if you find it useful, by this way it will help others.