How to get EmbedToken Generated ?

[uaydogdu]

Dear All,

we have difficulty in getting EmbedToken.

1. We can get AccessToken calling https://login.microsoftonline.com/common/oauth2/token   with "grant-type:password"

2. Using AccessToken from first step we

POST https://api.powerbi.com/v1.0/myorg/groups/{groupId}/reports/{reportId}/GenerateToken

3. Altough we give all permissions to the user ,We get

{

    "error": {

        "code": "Unauthorized",

        "message": "Report.Read.All Dataset.Read.All"

    }

}

4. We logged in to https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/reports-generate-token-in-group#code...

with the user account that we use to get the AccessToken (first step)

5. We are able to get EmbedToken.

What would be the difference between the AccessTokens getting at the first and the fourth steps?

Any help appreciated

Regards

[uaydogdu]

Dear Rico ,

First of all, Thank you very much for your quick response. As far as I understand you explain the differences between Entra ID Token and Embed Token and how to obtain them.

My question was , we get Entra ID Token (Access Token)  by 2 ways  with the same master user account. First Way cannot generate Embed Token and the second way does generate, What is missing with first way?

1st Way.  Calling Api ( https://login.microsoftonline.com/common/oauth2/token )

2nd Way.  Login Api Playground https://learn.microsoft.com/en-us/rest/api/power-bi/embed-token/reports-generate-token-in-group

Copied "Authorization" .

Best Regards,

[v-rzhou-msft]

Hi @uaydogdu ,

I think you can try to call the Power BI API resource url for accress token : "https://analysis.windows.net/powerbi/api". 

For reference: Solved: REST API Get Access Token - Microsoft Fabric Community

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[uaydogdu]

Dear Rico ,

We've already call "https://analysis.windows.net/powerbi/api" to get access token.

 On application registration we gave full control for the master user to the app. 

On our postman response we get Report.Read.All as scope. 

Is the "Report.Read.All" enough for getting Embed Token?

What could be the reason we dont see the rest of the scope items in response? 

Thank you very much in advance,

Regards

[v-rzhou-msft]

Hi @uaydogdu ,

What would be the difference between the AccessTokens getting at the first and the fourth steps?

Firstly, you will get Entra ID Token (Access Token) by Master User (Account and Password) or Service principal as authentication.

Then you will use this access token to get Embed token in below step.

So they are different.

You may refer to workload and offical blog for more details.

For reference: Permission tokens needed to embed a Power BI app - Power BI | Microsoft Learn

For reference:
Generate an embed token in Power BI embedded analytics - Power BI | Microsoft Learn

As far as I know, here you are using master user (password) as authentication.

I think you need to give permissions as below when you register your Microsoft Entra application.

All of the following, unless a requirement doesn't apply:

• Report.ReadWrite.All or Report.Read.All
• Dataset.ReadWrite.All or Dataset.Read.All
• Content.Create, required if the allowSaveAs flag is specified in GenerateTokenRequest

For reference:

Embed content in your Power BI embedded analytics application - Power BI | Microsoft Learn

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.