Forum Discussion
Connect Microsoft 365 Lighthouse Power BI
- 10 months ago
Hi SantiagoG2310,
In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).
- Set Supported account types to Multitenant and Grant admin consent.
- Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
- Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
- Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.
If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.
Thanks and regards,
Anjan Kumar Chippa
Hi Aala_Ali,
Thank you for your response, excuse my lateness. I've verified and tried every step in your answer but the error persists. I share some code fragment of my connector and Azure app registration settings screenshots.
Authentication:
API permissions:
Connector.pq
GetAccessToken = (optional tenantId as text, optional scope as text) =>
let
authResult = if (tenantId <> null) then
TokenMethod("https://login.microsoftonline.com/" & tenantId & "/oauth2/v2.0/token", "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
else
TokenMethod(token_uri, "refresh_token", "refresh_token", Extension.CurrentCredential()[refresh_token], scope)
in
authResult[access_token];
Logout = (token) => logout_uri;
Refresh = (resourceUrl, refresh_token) => TokenMethod(token_uri, "refresh_token", "refresh_token", refresh_token);
StartLogin = (resourceUrl, state, display) =>
let
authorizeUrl = authorize_uri & "?" & Uri.BuildQueryString([
client_id = client_id,
redirect_uri = redirect_uri,
state = state,
scope = "offline_access openid profile https://graph.microsoft.com/.default",
response_type = "code",
response_mode = "query",
prompt = "select_account"
])
in
[
LoginUri = authorizeUrl,
CallbackUri = redirect_uri,
WindowHeight = 860,
WindowWidth = 1024,
Context = null
];
TokenMethod = (tokenUri, grantType, tokenField, parameter, optional scope as text) =>
let
queryString = [
client_id = client_id,
scope = if (scope <> null) then scope else "offline_access https://graph.microsoft.com/.default",
grant_type = grantType,
redirect_uri = redirect_uri
],
queryWithCode = Record.AddField(queryString, tokenField, parameter),
tokenResponse = Web.Contents(tokenUri, [
Content = Text.ToBinary(Uri.BuildQueryString(queryWithCode)),
Headers = [
#"Content-type" = "application/x-www-form-urlencoded",
#"Accept" = "application/json"
],
ManualStatusHandling = {400, 401, 403}
]),
body = Json.Document(tokenResponse),
result = if (Record.HasFields(body, {"error", "error_description"})) then
error Rest.GetError(body)
else
body
in
result;
Hi SantiagoG2310,
In Entra ID app registration, add a Web platform and register this exact redirect url: https://oauth.powerbi.com/views/oauthredirect.html (not under SPA only).
- Set Supported account types to Multitenant and Grant admin consent.
- Add delegated Graph permissions the connector needs (include offline_access, openid, profile) and then Grant admin consent in the MSP/partner tenant.
- Use v2 authorize endpoint and request explicit delegated scopes like offline_access openid profile User.Read ManagedTenants.Read.All
- Rebuild the connector .mez, place it in the Custom Connectors folder, clear desktop credentials, restart desktop and sign in again.
If sign in still fails, open the authorize url in a browser and check Entra ID sign in logs and get the AAD error message and share it here so that we can look more into it.
Thanks and regards,
Anjan Kumar Chippa