Forum Discussion
For Azure Support team: What permissions are required to generate a PBI Embedded token?
What is the actual error? I didn't see that listed.
From the sounds of it though, it has to do with the permissions on the App registration. You indicated you did do the Grant Permission step, which was the first thing I thought was missed when reading this initially, but you said you did it. and it works for your account. I'm assuming you performed the Grant Permissions step with your account.
I'm also going to assume that your account is not a Global Admin of the tenant. Let me know if that assumption is incorrect.
If you perform Grant Permission with a non-Global Admin account, it only performs that Grant Permission action on the account signed in. Meaning if you want other accounts to be able to use it as well, they would also need to do the Grant Permission action to pre-consent for their accounts. If you perform the Grant Permission step with a Global Admin account, it will pre-consent every account within the tenant and my guess is you would not have seen a problem.
The guidance in the documentation is to either perform the Grant Permission step with the account that will be doing the embedding or to do it with a Global Admin account. There is also the following blurb listed for Step 6 of performing these steps in the Azure AD portal:
The Grant Permissions action is needed for the master account to avoid being prompted for consent by Azure AD. If the account performing this action is a Global Admin, you will grant permissions to all users within your organization for this application. If the account performing this action is the master account and is not a Global Admin, you will grant permissions only to the master account for this application.
Let me know if that doesn't align with what you have done, or doesn't make sense.
Hi Adam!
Thanks so much for popping into this thread! It was a good assumption, but actually, my account is a global administrator. See the screenshot I just took from the Azure portal (below).
Now, the second account is also a Global administrator. Should that account login and grant itself permissions? Based on what you said, it shouldn't be necessary, but is that worth verifying?
Also, I can grab and post screenshots of my other settings. I'd only have to edit them to remove any confidential info. If you think that's help, let me know which screenshots would be helpful.
Thanks again!!
I have an update from my dev team. They are getting an embed token when using the second ID; however, the report isn't rendering, and they're getting a 401. Here are two screenshots:
When they switch to my account, the report renders. Also, just to double check, the Group ID is in the URL for the report while looking at it in powerbi.com, right? I seem to recall your video saying that. The URL also includes the Report ID.
Have you forced the new account to login by going through the Grant Permissions step?
You can force the embed page to bring up the Grant Permissions page with the following snippet:
authenticationResult = await authenticationContext.AcquireTokenAsync(
ResourceUrl,
ClientId,
new Uri("uriendpoint"),
new PlatformParameters(PromptBehavior.Always));
