PowerBI Embed in Web Application for Organization without giving user access to Workspace

[arpandesai]

We have embedeed Power BI report for users for organization. Report embedding is working fine if we add user to power bi workspace as viewer. 

But only issue is, We don't want to give viewers access to user. we are using user's identity to generate token. we have given report and dataset level permission to user from Manage Permission and Security.

[arpandesai]

we are using below code:

public string GetAccessToken()
{
return this.tokenAcquisition.GetAccessTokenForUserAsync(RequiredScopes).Result;
}

public PowerBIClient GetPowerBiClient()
{
var tokenCredentials = new TokenCredentials(GetAccessToken(), "Bearer");
return new PowerBIClient(new Uri(urlPowerBiServiceApiRoot), tokenCredentials);
}

public async Task<EmbeddedPowerBIReport> GetReport(Guid WorkspaceId, Guid ReportId)
{
PowerBIClient pbiClient = GetPowerBiClient();

// call to Power BI Service API to get embedding data
var report = await pbiClient.Reports.GetReportAsync(WorkspaceId, ReportId);

// return report embedding data to caller
return new EmbeddedPowerBIReport
{
Id = report.Id.ToString(),
EmbedUrl = report.EmbedUrl,
Name = report.Name,
Token = GetAccessToken(),
StatusMessage = "Success",
StatusSuccess = string.IsNullOrEmpty(report.DatasetId) ? false : true
};
}

In above code snippet, if we don't give workspace level permission to user they are getting error saying "Microsoft.Rest.HttpOperationException: Operation returned an invalid status code 'Unauthorized'\r\n   at Microsoft.PowerBI.Api.ReportsOperations.GetReportInGroupWithHttpMessagesAsync(Guid groupId, Guid reportId, Dictionary`2 customHeaders, CancellationToken cancellationToken)\r\n   at Microsoft.PowerBI.Api.ReportsOperationsExtensions.GetReportInGroupAsync(IReportsOperations operations, Guid groupId, Guid reportId, CancellationToken cancellationToken)"

But when we give user permission to workspace as viewere they are able to load report on web pages as embedded report. 

In all cases, i have make sure they have access at report level and workspace level. we just want to make sure users wont be able to see other report in workspace if they navigate through msit.powerbi.com

[Anonymous · Accepted solution]

Hi @arpandesai ,

View permissions are set in the Power BI service and the Embed option doesn’t automatically permit users to view the report. The user use their own credentials to authenticate when embed for organization. They need to have a pro license or PPU license to consume the report only in the case that the contents located in Premium capacity. 

The user can see the embedded content normally even if they are not granted viewer access to the workspace, as long as they have the necessary permissions at the report and dataset level. 

Best Regards