Forum Discussion
Embed for your Organization (User Owns Data) - C#, Forbidden, Invalid Token
I discussed with MS Support. If your org uses AzureAD such as https://login.microsoftonline.com and https://portal.azure.com/ but uses Power BI Gov GCC (API endoint https://api.powerbigov.us) then the scopes must be in https://analysis.usgovcloudapi.net. The primary problem was registring that API Permission within the Entra app registration. The trick to doing this is when adding the Request API Permission you must select "APIs my organization uses". Then realize that search is not a wild card search so you can't just search for Gov or Power. You have to locate the "Microsoft Power BI Government Community Cloud". That's it. Within app I only switched scopes such as https://analysis.usgovcloudapi.net/powerbi/api/Workspace.Read.All and it works. AzureAD is https://login.microsoftonline.com and Power BI endpoint is https://analysis.usgovcloudapi.net.
Super UserHi ejk0226 ,
The 403 Forbidden / InvalidToken error is occurring because you are calling the Power BI US Government (GCC) API endpoint at https://api.powerbigov.us, but your application is configured to get tokens for the standard commercial cloud. Your token's audience (aud) claim, https://analysis.windows.net/powerbi/api, is correct for the commercial service. Because the government and commercial clouds are completely separate environments, a token issued for one is invalid in the other, leading to the rejection. The fix is to change the API endpoint in your code to the commercial URL.
Your overall strategy of using the "Embed for your organization" (User owns data) model is correct for your goal of embedding content for internal, licensed users without incurring extra capacity costs. The Power BI admin settings and documentation you found regarding service principals are not relevant to your implementation. Those apply to the "Embed for your customer" (App owns data) model, which uses a different authentication flow. Your method, which uses GetAccessTokenForUserAsync, correctly relies on delegated user permissions (scopes), where the signed-in user's own license and permissions grant access to the content.
To resolve the error, you only need to modify the URL in your GetAsync call. The rest of your token acquisition logic and scope definition is correct for your scenario.
var accessToken = await tokenAcquisition.GetAccessTokenForUserAsync(scopes);
var client = httpClientFactory.CreateClient();
client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);
// Change the URL from "api.powerbigov.us" to "api.powerbi.com"
var response = await client.GetAsync("https://api.powerbi.com/v1.0/myorg/reports");
response.EnsureSuccessStatusCode();
Best regards,
This is helpful. However, can I go in the other direction by configuring my application to get tokens from the government cloud? How/where do I switch that? The reports I'm after are hosted on https://app.powerbigov.us/home. This is where I have a Pro license and report users also have Pro licenses.
I can navigate to commerical https://app.powerbi.com/home with my gov credentials. It shows I have a Free account type with no reports. When I do as you suggest and change my endoint then yes I get a response. It's an empty list of reports because I have no reports hosted there but at least it's a 200 OK instead of error.
Reading into what you describe, it sounds like I need to get different tokens. The tokens defined (https://analysis.windows.net/powerbi/api/) came from me going into the Entra App registration (https://portal.azure.com/) and adding API permissions. I only see Power BI Service and no gov option. A quick good search pointed me to a Gov azure portal at https://portal.azure.us/ however that tells me by org/domain is not registered.
- DataNinja777
Hi ejk0226 ,
Thank you for the clarification. You're absolutely right to go in the other direction since your reports and licenses are in the government cloud. Your diagnosis is spot on: you need to get a token issued from the government cloud's identity provider. The reason your current code gets a commercial token is because the Microsoft Identity library defaults to the commercial Azure endpoints. You can fix this by explicitly telling your application to authenticate against the US Government endpoint instead.
You can accomplish this with a small change in your appsettings.json file. You do not need a separate app registration in the Azure Government portal (portal.azure.us); your existing registration is fine. You simply need to change the "Instance" for your Azure AD configuration from the commercial endpoint to the government endpoint. You should change the configuration from this:
"AzureAd": { "Instance": "https://login.microsoftonline.com/", "TenantId": "[your-tenant-id]", "ClientId": "[your-client-id]", //... other settings }...to this, noting the change in the URL:
"AzureAd": { "Instance": "https://login.microsoftonline.us/", "TenantId": "[your-tenant-id]", "ClientId": "[your-client-id]", //... other settings }By changing the instance to https://login.microsoftonline.us/, you are telling the AddMicrosoftIdentityWebApp service to use the US Government authority for all token requests. This will produce a token that is valid for government cloud resources. With this configuration change in place, your C# code for calling the API should remain exactly as it was in your original post, as the powerbigov.us endpoint is now the correct one to use with your new government-issued token.
// This URL is now correct because you'll have a gov-issued token var response = await client.GetAsync("https://api.powerbigov.us/v1.0/myorg/reports");The scopes you defined are also correct and do not need to be changed. The resource URL, https://analysis.windows.net/powerbi/api, is the same for both commercial and government clouds. The key difference, which your configuration change will fix, is the issuer of the token.
Best regards,