Issues with Power BI API Permissions for Exporting Reports to PDF Using Azure AD App

[Pondwar]

Hi everyone,

I’m trying to automate the process of exporting Power BI reports to PDF using the Power BI REST API. I’ve registered an app in Azure AD and am using the Client Credentials flow to authenticate. However, I’m facing several issues, and I’m not sure how to resolve them:

Token Permissions Issue:

The token generated using the Client ID, Client Secret, and Tenant ID does not seem to have the required permissions. When I try to export a report, I get the following error:

API is not accessible for application

I’ve already added the following permissions to the app in Azure AD under API Permissions:

Dataset.ReadWrite.All

Report.ReadWrite.All

Workspace.ReadWrite.All

I also clicked Grant admin consent, but the issue persists. When I decode the token on jwt.ms, the scp (scopes) claim does not include these permissions.

Export to PDF Error:

When I try to export a report to PDF, I get the error:

The first argument must be of type string or an instance of Buffer, ArrayBuffer, or Array or an Array-like Object. Received an instance of Object

I’m using the responseType: 'arraybuffer' option in my API call, and I’m saving the response using fs.writeFileSync. I suspect this might be related to the token permissions issue.

Using a Service Account:

I can successfully export reports when logged into the Power BI portal using my service account. However, I want to automate this process without manual intervention. Is there a way to use the service account credentials directly in the script, or do I need to rely on the Azure AD app?

Azure Portal Configuration:

The Azure Portal interface seems to have changed, and I’m not sure if I’m missing any steps in configuring the app. Could someone provide updated instructions for setting up an Azure AD app with the correct permissions for Power BI?

Here’s a summary of my setup:

Client ID: Registered in Azure AD.

Client Secret: Created and valid.

Tenant ID: Correctly configured.

Power BI API Calls: Using axios in Node.js to call the REST API.

Any guidance on how to resolve these issues would be greatly appreciated. I’m stuck and not sure what else to try.

{

  "typ": "JWT",

  "alg": "RS256",

  "x5t": "CNv0OI3RwqlHFEVnaoMAshCH2XE",

  "kid": "CNv0OI3RwqlHFEVnaoMAshCH2XE"

}.{

  "aud": "https://analysis.windows.net/powerbi/api",

  "iss": "xxx",

  "iat": 1745612098,

  "nbf": 1745612098,

  "exp": 1745615998,

  "aio": "k2RgYHheyV5UrcN2Qd/n0OSKoFcmAA==",

  "appid": "xxx",

  "appidacr": "1",

  "idp": "xxx",

  "idtyp": "app",

  "oid": "xxx",

  "rh": "1.AVkA7qbazHqcDkOUl_IOUxg1gwkAAAAAAAAAwAAAAAAAAABZAABZAA.",

  "roles": [

    "Tenant.ReadWrite.All",

    "Tenant.Read.All"

  ],

  "sub": "4d28a243-42f0-449e-ba83-3adac80487ee",

  "tid": "ccdaa6ee-9c7a-430e-9497-f20e53183583",

  "uti": "3Qh2PqKplkqffhtKNbpSAA",

  "ver": "1.0",

  "xms_idrel": "7 30",

  "xms_rd": "0.42LlYBJijAQA"

}.[Signature]

Thank you in advance for your help!

[tharunkumarRTK]

@Pondwar 

Are you sure your service principal has permissions to run the API?

1. Have you enabled required tenant settings to run the APIs and to run APIs using service principles. You have to add your SPN to a security group and add that security group under this setting under admin. portal in order to endable it 

2. Have you added the SPN to the workspace? if not then add that SPN to the workspace and then run the API call

3. Follow the microsoft documentation in order to check if there is any syntactical errors in your API call.

Adding permissions from the AZURE portal is not enough and it is not required if it is standalone appplication permissions and those are managed through tenant admin portal

Need a Power BI Consultation? Hire me on Upwork

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!

 

[Pondwar]

Hello,

Thanks for the reply. I reviewed the API permissions in the PowerBI administrator portal and they are correct, as shown in the picture you showed me.

The error I have is related to the permissions within the AZURE Portal.

I also added the application permission to the workspace.

The jwt.ms portal does not show all the permissions I am granting to my application.

I also granted the application permissions as a Service Principal.

[v-dineshya]

Hi @Pondwar  ,

Thank you for reaching out to the Microsoft Community Forum.

As you mentioned that, you have issue related to the permissions within the AZURE Portal.

I recommend posting this query in the dedicated Microsoft Q&A: Azure Active Directory Forum, where the Azure Identity and Access Management team can better assist with.

Microsoft Entra ID - Microsoft Q&A

If my response has resolved your query, please mark it as the Accepted Solution to assist others. Additionally, a 'Kudos' would be appreciated if you found my response helpful.

Thank you