Forum Discussion

ninabseeq's avatar
ninabseeq
New Member
6 years ago

Authenticating OData feed from 3rd-party app with Azure AD

I'm a developer of a 3rd-party app that allows users to export OData feeds, which can then be imported into PowerBI. Some of our users use SSO providers (such as Azure Active Directory, and other OAuth providers), and they would like to be able to use these credentials to authenticate OData feeds in PowerBI. I'm trying to enable this.

 

So far, I created an Azure app and used the "Organizational account" option in the OData feed window to allow a user to sign in with their Microsoft credentials - I did this by having my app reply to PowerBI's initial auth message with an authorization URI (login.microsoftonline.com). Then I can sign in with my credentials. When I click "Connect", PowerBI then sends my app an access token. If I use this token from my app to request a user profile from the UserInfo endpoint on Azure, I get the following error: 
"AADSTS9001014: This token was not issued for the UserInfo endpoint. This may have been a token for Graph or another resource." 

I'm not sure where this is going wrong (the way I configured the Azure app, the URIs I'm using, etc.) or if what I'm trying to do is even possible, but any pointers would be appreciated!

2 Replies

  • JirkaZ's avatar
    JirkaZ
    Icon for Solution Specialist rankSolution Specialist

    did you request correct scopes when authenticating?

    • ninabseeq's avatar
      ninabseeq
      New Member

      It's not immediately apparent what scopes PowerBI is requesting in its request to Azure AD, but I know it's at least requesting the user_impersonation scope. Adding scopes (openid, profile, email) to the authorization_uri that my app sends to PowerBI doesn't seem to fix the issue.