Embed PowerBI in Customer's Hosted Browser and Web Application

[fxs7576_02]

Hi PowerBI Community,

My customers would like to embed my PowerBI reports in their browsers and web applications. Using service principal (as per this documentation), so far my understanding is that I need to share these five parameters with them so that they will get both [embed_url] and [embed_access_token] (which only valids for an hour, thus it needs to be refreshed every hour):

• client_id
• client_secret
• tenant_id
• workspace_id
• report_id

Sharing the first three parameters sounds risky as they might be able to access and control assets outside the intended scope. Are there any alternative ways for me to safely provide them [embed_url] and [embed_access_token]?

Thank you in advance.

[Anonymous]

Hi  @fxs7576_02 ,

For your needs: Is there another way to securely provide [embed_url] and [embed_access_token]? If you are not comfortable directly providing the client_secret to the customer, you can use the suggested methods in the documentation to dynamically generate the embed_access_token using Postman or Power Automate’s HTTP action. By using the dynamically generated embed_access_token for embedding your reports, you can ensure a higher level of security.

Postman documentation overview | Postman Learning Center

Using the HTTP action to make requests with Microsoft Flow - Microsoft Power Platform Blog

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[fxs7576_02]

Thanks @Anonymous . Indeed that I'm not comfortable sharing the client_secret_key.

---

the suggested methods in the documentation to dynamically generate the embed_access_token using Postman or Power Automate’s HTTP action

---

---

If I use Postman with service principal method to generate embed_access_token, which key-value pairs are required? And will the generated embed access token have an expiration of an hour, after which I need to keep providing them a new one every hour?

So far the only step-by-step documentation for Postman I've found (here) requires a username and password, the key-value pairs which are only for available for Master User method.