Forum Discussion
For Azure Support team: What permissions are required to generate a PBI Embedded token?
I got it working!! There are a lot of touch points for permissions, and security. I am going to write a post here, along with diagrams. The short story is that I removed other test users from Azure and Power BI. Then I created the special "master" account that all users will impersonate for the Power BI Embedded reports. I gave that user a Power BI Pro license, but no other licenses (e.g., nothing from Office 365). From my personal powerbi.com account (Pro license), I made sure to make this new master account an Admin for the Workspace and I shared the report with that new user. I then logged into powerbi.com with this new master account, and verified that I could access the report and that I had admin permissions.
Now, as I said, there are number of permissions touch points in Azure. I'm not 100% sure that all of them are required, but I decided to add access for the new master account anyway. I'll write up a proper post tomorrow.
I'm going to reiterate that setting up Power BI Embedded is far more complicated than it needs to be. Version 2 of PBI Embedded still feels like a solution that was cobbled together instead of a more mature, integrated solution.
More to follow, but thanks to Adam/GuyInACube & KalberPowerBI for the help!!
AdministratorCorrect. That is what I was stating previously. The Grant Permission step is required from the App registration permission and has to be applied to the "master" account (whatever user account that is being used) as indicated above. That "master" account needs to be an admin of the app workspace where the content is being embedded from. The master account also requires a Power BI Pro license.
Doesn't matter what account is used, It just needs to have all of the above applied.