Client Credentials Grant Type Issue with Power BI API, Password Grant Successful

[Lingaraj-Mishra]

Hello Power BI Community,

I am experiencing difficulty with authenticating API requests using the OAuth 2.0 client credentials grant type for the Power BI REST API, although the password grant type works without issue. I am trying to access https://api.powerbi.com/v1.0/myorg/datasets which requires authentication tokens that I am attempting to retrieve via Azure Active Directory (Azure AD).

Here is a breakdown of the steps I've followed:

1. Application Registration: I registered my application in Azure AD, ensuring it has the necessary API permissions for Power BI 

2. Token Request with Client Credentials:

   1. I am using the endpoint https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token for token generation. Here’s the curl command I use (with sensitive data omitted):
   2. curl -X POST https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "client_id={client_id}" \
      -d "client_secret={client_secret}" \
      -d "grant_type=client_credentials" \
      -d "scope=https://analysis.windows.net/powerbi/api/.default"
   3. 401 Unauthorized Error: Despite following all documented steps and verifying that the client ID, secret, and tenant ID are correct, I receive a 401 Unauthorized error when I attempt to use the generated token to make API requests. Interestingly, if I switch to using the OAuth 2.0 password grant type to generate a token, everything works as expected.

Here are some additional details:

• The application permissions in Azure AD include all necessary Power BI related permissions and have been granted admin consent.
• There are no alerts or incidents reported on the Azure status page that indicate an ongoing issue with Azure AD or Power BI services.

Questions:

1. Is there a known issue in authentication mechanisms for Power BI that might affect the client credentials flow?
2. Are there known issues or maintenance activities affecting the OAuth 2.0 client credentials grant type for Power BI APIs?
3. Could there be specific tenant configurations in Azure AD that might restrict or alter the expected behavior of the client credentials grant?
4. Any suggestions on troubleshooting steps or alternative configurations that could resolve or work around this issue?

I appreciate any insights or suggestions you might have. Thank you for your help!

[lbendlin · Accepted solution]

1. yes

2. yes

3. no

4. Use a custom connector with AAD, for example  GitHub - migueesc123/PowerBIRESTAPI: A Microsoft Power BI Data Connector or Power Query Connector fo...

[Lingaraj-Mishra]

@lbendlin Thanks for your quick response. Do you have any documented evidance on Q1 that is on known issue in authentication mechanisms.

[lbendlin]

For Q1 read through Chris Webb's blog.