Forum Discussion
Access PowerBI Report - when users having multiple Microsoft account from different Org
Hi Team,
We have published several PowerBI reports accessible to all authenticated users within our web application via an iframe, with a total user base of over 60,000. Everything works well because we have SSO configured with the same Identity Provider (IDP).
However, we encounter issues when users are already logged in with a different Microsoft account, leading to an error message stating "report not found." While this is technically expected, it is not ideal from a user perspective. We want to understand if we can embed the client or tenant ID in the report URL to ensure it always checks for the session of a specific tenant or Microsoft account, avoiding these issues for users.
We have a couple of options but bot feasible at this point of time for us so looking for alternatives.
1. Training the user base, which is challenging given the current circumstances.
2. Embedding the report using Javascript
2.1 Register the application in Azure AD.
2.2 Configure API permissions.
2.3 Create a client secret.
2.4 Implement server-side authentication and token generation.
2.5 Embed the report client-side.
The problem with this approach is that the access token would be accessible at the UI layer,which we are not comfortable sharing.
Please suggest if there is a way to enforce the PowerBI report URL to use a specific tenant or account.
Hi Gautam_Sharma ,
You must grant the service principal ReadOverrideEffectiveIdentity permission. Otherwise, the service principal can’t delegate the user identity to the gateway.
The following link will help you:
Power BI Embedded, Service Principals, and SSAS – Prologika
Best Regards,
Xianda Tang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
4 Replies
Hi Gautam_Sharma ,
I recommend considering the "embed for customers" scenario and for service principal authentication. This method allows you to embed Power BI content for users without requiring them to have a Power BI account or sign in to a Microsoft account.
The whole step is pretty much the same as you said.
Use the service principal to get an access token from Azure AD. This token is then used to authenticate API requests to Power BI in order to embed the report. This process ensures that the access token isn't exposed at the UI layer.
Below is the official link will help you:
Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft LearnBest Regards,
Xianda Tang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thanks Anonymous for response. I followed the suggested appraoch however I am getting below error message could you please suggest what I am missing at my end.Appreciate your support.
Error: 400 Bad Request: "{"error":{"code":"InvalidRequest","message":"Creating embed token for accessing dataset XXXXX-XXX-XXX-XXX-XXXXXXXX requires effective identity to be provided"}}" Request Id: <Request-ID>Hi Gautam_Sharma ,
You must grant the service principal ReadOverrideEffectiveIdentity permission. Otherwise, the service principal can’t delegate the user identity to the gateway.
The following link will help you:
Power BI Embedded, Service Principals, and SSAS – Prologika
Best Regards,
Xianda Tang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thanks for pointing me in right direction.I am able to proceed now however I am facing below issue.
Is there anything I am missing at my end ? Kindly suggest
