Forum Discussion
For Azure Support team: What permissions are required to generate a PBI Embedded token?
Hi Adam!
Thanks so much for popping into this thread! It was a good assumption, but actually, my account is a global administrator. See the screenshot I just took from the Azure portal (below).
Now, the second account is also a Global administrator. Should that account login and grant itself permissions? Based on what you said, it shouldn't be necessary, but is that worth verifying?
Also, I can grab and post screenshots of my other settings. I'd only have to edit them to remove any confidential info. If you think that's help, let me know which screenshots would be helpful.
Thanks again!!
I have an update from my dev team. They are getting an embed token when using the second ID; however, the report isn't rendering, and they're getting a 401. Here are two screenshots:
When they switch to my account, the report renders. Also, just to double check, the Group ID is in the URL for the report while looking at it in powerbi.com, right? I seem to recall your video saying that. The URL also includes the Report ID.
Have you forced the new account to login by going through the Grant Permissions step?
You can force the embed page to bring up the Grant Permissions page with the following snippet:
authenticationResult = await authenticationContext.AcquireTokenAsync(
ResourceUrl,
ClientId,
new Uri("uriendpoint"),
new PlatformParameters(PromptBehavior.Always));Have you forced the new account to login by going through the Grant Permissions step?
I would force the embed page to bring up the Grant Permissions page and use your new "master" account credentials:
authenticationResult = await authenticationContext.AcquireTokenAsync(
ResourceUrl,
ClientId,
new Uri("youruriendpoint"),
new PlatformParameters(PromptBehavior.Always));- GuyInACube
Administrator
Ah! that's helpful. i thought you were getting a 401 on the GenerateToken call. So, if you are getting a 401 when trying to embed a report, the master account being used doesn't have access to the report or the App workspace, or isn't an admin of the app workspace. It's a permission issue. They should be an admin of the app workspace where that report is published to.
I got it working!! There are a lot of touch points for permissions, and security. I am going to write a post here, along with diagrams. The short story is that I removed other test users from Azure and Power BI. Then I created the special "master" account that all users will impersonate for the Power BI Embedded reports. I gave that user a Power BI Pro license, but no other licenses (e.g., nothing from Office 365). From my personal powerbi.com account (Pro license), I made sure to make this new master account an Admin for the Workspace and I shared the report with that new user. I then logged into powerbi.com with this new master account, and verified that I could access the report and that I had admin permissions.
Now, as I said, there are number of permissions touch points in Azure. I'm not 100% sure that all of them are required, but I decided to add access for the new master account anyway. I'll write up a proper post tomorrow.
I'm going to reiterate that setting up Power BI Embedded is far more complicated than it needs to be. Version 2 of PBI Embedded still feels like a solution that was cobbled together instead of a more mature, integrated solution.
More to follow, but thanks to Adam/GuyInACube & KalberPowerBI for the help!!
- GuyInACube
Correct. That is what I was stating previously. The Grant Permission step is required from the App registration permission and has to be applied to the "master" account (whatever user account that is being used) as indicated above. That "master" account needs to be an admin of the app workspace where the content is being embedded from. The master account also requires a Power BI Pro license.
Doesn't matter what account is used, It just needs to have all of the above applied.
