Access PowerBi API on a CGG

[estuck1991]

Hi All, 

I am trying to view reports through API endpoint https://api.high.powerbigov.us/v1.0/myorg/reports.
I have and app registration in azure with a client secret and permissions on api as follows:

Using the following I get a token from https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token

However when i try to use the token i get X-PowerBI-Error-Info: InvalidToken

I have set the "Service Principals can use Fabric API's" to a security group and have made sure the azure app registration is in that security group.

Is there something that i am missing in the configuration?

[v-yangliu-msft · Accepted solution]

Thanks for the reply from lbendlin , please allow me to provide another insight: 
Hi  @estuck1991 ,

If the token generated by the service principal runs the API, the application should not grant any delegated permission, but should grant application permission. For specific permisson configuration needs, please refer to this restriction document:

Token - Generate Token - REST API (Power BI Power BI REST APIs) | Microsoft Learn

For the tenant admin setting that needs to be turned on, please refer to this document:

Use service principal profiles to manage customer data in multitenant apps - Power BI | Microsoft Le...

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[lbendlin]

As I understand it the issue may be with the Delegated scope. Try the app registration again but choose the other, non-delegated option.

[estuck1991]

I have switched to the only 2 API permissions for the Application Permissions on Microsoft Power BI Government Community Cloud.

However still getting 403 forbidden with invalidtoken