Error 403 "User is not authorized" returned when calling GenerateTokenInGroup Power BI API

[pedrosilvacreit]

Hello.

I'm trying to use service principal to authenticate an Entra ID app, to then generate a token to use to embed a Power BI report. I've followed the steps in this link, register the app, without permission has the advice, created the security group, enabled the Power BI service admin settings and added service principal to the workspace. The call to acquire the client token is successful and returns an access token. This is a screenshot of the parameters (I've omitted the sensitive data):

However, using the access token returned in the GenerateTokenInGroup request, is returning a 403 error response, with this message: 

{
    "error": {
        "code": "Unauthorized",
        "message": "User is not authorized"
    }
}

I've seen a lot of documentation, but I still haven't understood the issue. I've read somewhere that service principal authentication might not work with GenerateTokenInGroup, but found no definitive answer or an alternative solution. The documentation available is not very clear and misses important points. 

Any help would be greatly appreciated.

Thank you. 

[Anonymous]

Hi @pedrosilvacreit ,

Base on your description, it seems like it is authentication error. Could you please check the following info for the further troubleshooting?

1. Did you add API permission 'Dataset.Read.All' and 'Report.Read.All', make sure to grant admin consent for these permissions

2. Did you grant the security group which service principal be added in the Admin or Member role to the workspace?Embed Power BI content in an embedded analytics application with service principal and an applicatio... 

3. Please refer the following links to try to solve the problem:

Solved: Getting 403 when calling power bi rest api from po... - Microsoft Fabric Community

API call returns 403

Best Regards

[pedrosilvacreit]

Hello @Anonymous!

Thanks for your response.

1. No, I don't have those API permissions added. The documentation I saw said that service principal authentication didn't require API permissions.

2. Yes, I've granted both the service principal and the security groups the Admin role to the workspace.

[Anonymous]

Hi @pedrosilvacreit ,

Thanks for your reply. Could you please check the following info?

1. Make sure the client id and client secret fill in correctly, especially for the value of client secret. You can refer the following links to get them

Client ID

Client secret

2. Enable the Power BI service admin settings

Enable Embed content in apps

Enable Allow service principals to use Power BI APIs

Permission tokens needed to embed a Power BI app - Power BI | Microsoft Learn

Best Regards