Aad VS Embed token

Hello.

We have an angular app that embeds PowerBI report. There is a user in our Entra tenant with PowerBI Pro license. This user was used to obtain token and pass it to PowerBI service. Recently we had to enable MFA for that user and got a problem.

Previous code was like this (we can't use interactive auth flow due to business requirement).

Backend:

        public async Task<string> GetToken()
        {
            var formContent = new FormUrlEncodedContent(new[]
            {
                new KeyValuePair<string, string>("username", _username),
                new KeyValuePair<string, string>("password", _password),
                new KeyValuePair<string, string>("grant_type", "password"),
                new KeyValuePair<string, string>("resourse", _resourceUrl),
                new KeyValuePair<string, string>("client_id", _applicationId),
                new KeyValuePair<string, string>("scope", $"{_resourceUrl}/.default")
            });

            var myHttpClient = new HttpClient();
            var response = await myHttpClient.PostAsync($"{_authorityUrl}{_tenantId}/oauth2/v2.0/token", formContent);
            var stringContent = await response.Content.ReadAsStringAsync();
            var json = JsonConvert.DeserializeObject<AuthenticationResponse>(stringContent);
            if (json == null) json = new AuthenticationResponse();
            string access_token = json.access_token;
            return access_token;
        }

Frontend:

        let config: pbi.IEmbedConfiguration = {
            type: 'report',
            tokenType: pbi.models.TokenType.Aad,
            accessToken: token,
...
        };

After MFA has been enabled PowerBI stopped working and we have updated to following. Backend:

        private async Task<string> GetAadToken()
        {
            var cca = ConfidentialClientApplicationBuilder
                .Create(_applicationId)
                .WithClientSecret(_secret)
                .WithTenantId(_tenantId)
                .Build();

            var scopes = new string[] { $"{_resourceUrl}/.default" };
            var authResult = await cca.AcquireTokenForClient(scopes).ExecuteAsync();

            return authResult.AccessToken;
        }

        public async Task<string> GetPowerBIToken(Guid workspaceId, Guid reportId)
        {
            var tokenCredentials = new TokenCredentials(await GetAadToken());
            var client = new PowerBIClient(new Uri(_apiUrl), tokenCredentials);
            var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: TokenAccessLevel.View);
            var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(workspaceId, reportId, generateTokenRequestParameters);
            return tokenResponse.Token;
        }

 Frontend:

        let config: pbi.IEmbedConfiguration = {
            type: 'report',
            tokenType: pbi.models.TokenType.Embed, <========= Aad was changed to Embed
            accessToken: token,
...
        };

And now, when rendering PowerBI report there is a popup:

We have investigated it and figured out that now we need a capacity thay is way more expensive than PowerBI Pro license.

So, question is if there is any way to use non-interactive auth flow and get an AAD (not Embed) token that can be used to embed PowerBI.

Thanks!