PowerBIClient Forbidden issue

Hi all,

We're investigating the user of Power BI embedded for our SaaS app. In our scenario, we own the data and our end users would be utilizing the reports as non-power-bi users.

I've been struggling for a few days now to craft a working sample. Some samples I've found are no longer working or are for the old power bi azure implementation that's led to dead ends; however, I've gotten to the point where I'm very close to simply embedding a report in our Power BI setup.

Below is a simple console app I've come up with, many parts are from various documentation articles. The token is obtained fine, but when the request is submitted, I recieve HttpOperationException: Operation returned an invalid status code 'Forbidden'

private static string clientId = "----";
private static string secretKey = "----";
private static string groupId = "----";

        static void Main(string[] args)
        {
            string resourceUri = "https://analysis.windows.net/powerbi/api";

            string authorityUri = "https://login.windows.net/common/oauth2/authorize";

            ClientCredential credential = new ClientCredential(clientId, secretKey);
            AuthenticationContext authContext = new AuthenticationContext(authorityUri);

            string token = authContext.AcquireTokenAsync(resourceUri, credential).Result.AccessToken;

            var tokenCredentials = new TokenCredentials(token, "Bearer");

            using (var client = new PowerBIClient(new Uri("https://api.powerbi.com/"), tokenCredentials))
            {
                var reports = client.Reports.GetReportsInGroupWithHttpMessagesAsync(groupId);

                var faulted = reports.IsFaulted;

                // Here's where the exception is thrown
                var report = reports.Result.Body.Value;
            }
        }

Any ideas why? 

Here's what we've validated/tried:

• The AD User we've created the app under is not the global admin as recommended.
• The user is a power bi pro user (trial).
• The required permissions (Windows Azure Active Directory/Power BI Service) have been granted (we've checked off all to ensure we're not missing anything).
• We've validated/confirmed the client ID, secret key and group id many times.
• The Power BI workspace is private, but we've tried making a public one to be sure it doesn't matter.

Thank you in advance!