Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Find everything you need to get certified on Fabric—skills challenges, live sessions, exam prep, role guidance, and more. Get started

Reply
RyanBentham
Kudo Commander
Kudo Commander

Embedded - Accessing an external workspace

I'm currently building a PBI embedded solution and hoping someone could share some experience please.

 

I'm using the 'app owns data' approach and currently connect to a number of workspaces within my tenants PBI service. All works great

 

I have demoed the solution to a customer I'm working with and they asked about the possibility of using their workspaces (that currently hold a number of their key reports and datasets) in combination with the embedded instance that is hosted in my tenant. Essentially they want to outsource the embedded side of it to me and not have it live within their azure environment 

 

So my question is, is it possible for me to connect and authenticate against a Customer's workspaces from my tenant's embedded capacity?   

 

If so, are you aware of any documentation or have any suggestions on implementing this?   Would my azure app need to be added as a guest to the customers workspace access etc?

 

Thanks 

1 ACCEPTED SOLUTION

To connect to a customer's workspace via the Power BI REST API, your app would need to be added as a guest to the customer's tenant. Once the app has been added as a guest, you can use the OAuth 2.0 client credentials grant type for authentication. You would need to obtain the necessary client ID and secret from the customer's tenant. This information can be obtained from the Azure Active Directory in the customer's tenant, and is used to obtain an access token which is then used for making API requests. The customer would need to provide you with these credentials in order for your app to be able to access their workspace via the Power BI REST API.

View solution in original post

4 REPLIES 4
jaweher899
Super User
Super User

Yes, it's possible to connect and authenticate against a customer's Power BI workspaces from your tenant's embedded capacity, but you need to make sure that your Azure app has been added as a guest to the customer's workspace with the necessary access.

To implement this, you can use the Power BI REST API to connect to the customer's workspaces and retrieve the necessary data. You will also need to implement an authentication mechanism, such as OAuth 2.0, to ensure that the customer's workspaces are accessed securely.

Here is some documentation that may be useful:

You can also find more information about Power BI Embedded and Azure Active Directory authentication in the following documentation:

Thanks @jaweher899 

So in terms of connecting to the customer's workspaces via the Power BI REST API, my app should be added as a guest to the workspace/tenant, but how does the app then authenticate against the API?   Usually,  I do this via client credentials grant type using ID & Secret.  When auth be done some other way?   (or would i need the customer to provide client ids and secrets)?

Are you available for consultancy / freelance assistance? Please message me if so

Thanks

To connect to a customer's workspace via the Power BI REST API, your app would need to be added as a guest to the customer's tenant. Once the app has been added as a guest, you can use the OAuth 2.0 client credentials grant type for authentication. You would need to obtain the necessary client ID and secret from the customer's tenant. This information can be obtained from the Azure Active Directory in the customer's tenant, and is used to obtain an access token which is then used for making API requests. The customer would need to provide you with these credentials in order for your app to be able to access their workspace via the Power BI REST API.

Much appreciated @jaweher899 

Am I right in saying that in order for the customer to provide me with the necessary client ID and secret, they would need to also create an app registration on their end?

So just to confirm, the flow would look something like this:

1)  My app added as a guest on the customer's tenant/workpsaces
2)  Customer sets up AOD app registration and provides me with the clients ID & secret

3)  I use this to generate an access token

4) The access token can then be used to generate the embed token for the workspace artifacts that my App has access to?

Thanks

Helpful resources

Announcements
July 2024 Power BI Update

Power BI Monthly Update - July 2024

Check out the July 2024 Power BI update to learn about new features.

PBI_Carousel_NL_June

Fabric Community Update - June 2024

Get the latest Fabric updates from Build 2024, key Skills Challenge voucher deadlines, top blogs, forum posts, and product ideas.