Forum Discussion
Embed For Customer - DirectQuery
Hi v-nmadadi-msft ,
I can't configure group claims or app roles in the token for Azure SQL. Only Microsoft can do that, since they own the resource "https://database.windows.net" and determine which claims are included when a token is requested.
The only way this currently works is if the user has fewer than 160 AD groups or more than 200 AD groups. In the latter case, Azure AD replaces the group IDs in the "groups" claim with a Graph API URL, significantly reducing the token size.
I’ve received confirmation from Microsoft that there’s no workaround for this. I’ve submitted a Design Change Request to increase the identityBlob size limit from 10,240 bytes to at least 12,500 bytes, ensuring that tokens for users with around 160-200 AD groups can be accepted by the Power BI API /GenerateToken endpoint. Now, we’ll just have to wait for Microsoft to implement this fix.
Community SupportHi Anonymous,
Thanks for reaching out to the Microsoft fabric community forum.
Glad that you were able to pin point where the issue specifically occurs.
To try to solve issue related to full groups claim please refer to this reference document:
Configure group claims and app roles in tokens | Microsoft Learn
Also as per this document
Microsoft identity platform and OAuth 2.0 implicit grant flow - Microsoft identity platform | Microsoft Learn
Implicit grant flow should be avoided.
I hope these documents help guide you in the right direction toward resolving the issue.
If you find this post helpful, please mark it as an "Accept as Solution" and consider giving a KUDOS.
Thanks and Regards
Hi v-nmadadi-msft ,
I can't configure group claims or app roles in the token for Azure SQL. Only Microsoft can do that, since they own the resource "https://database.windows.net" and determine which claims are included when a token is requested.
The only way this currently works is if the user has fewer than 160 AD groups or more than 200 AD groups. In the latter case, Azure AD replaces the group IDs in the "groups" claim with a Graph API URL, significantly reducing the token size.
I’ve received confirmation from Microsoft that there’s no workaround for this. I’ve submitted a Design Change Request to increase the identityBlob size limit from 10,240 bytes to at least 12,500 bytes, ensuring that tokens for users with around 160-200 AD groups can be accepted by the Power BI API /GenerateToken endpoint. Now, we’ll just have to wait for Microsoft to implement this fix.
- v-nmadadi-msft
Hi Anonymous,
We really appreciate your efforts and for letting us know the update on the issue.
Happy to know that you got the confirmation on how to work around your error, Please consider accepting your reply as the solution so that it will be helpful to other community members who may face similar issue in the future and come across this Post.Please continue using fabric community forum for your further assistance.
Thanks and Regards