PowerBINotLicensedException - Service Principal with "embed for your customers" sample app?

Hi all,

Recently built an app using the "embed for your customers" ASP.NET Core sample app (Microsoft Tutorial). I'm hoping to use service principal authentication instead of master user, as it seems service principal is recommended for a production-quality embedding solution. I followed all of the applicable steps in the tutorial, and in this guide specifically for service principal too.

The issue we're seeing is that the sample app always displays the following for the iframe:

In the Dev Tools, I can see that the app is sending GET requests to this endpoint:

https://wabi-north-europe-redirect.analysis.windows.net/explore/reports/<my-report-id>/modelsAndExploration?preferReadOnlySession=true

And the response is always a 401 Unauthorized with this body:

{
    "error": {
        "code": "PowerBINotLicensedException",
        "pbi.error": {
            "code": "PowerBINotLicensedException",
            "parameters": {},
            "details": [],
            "exceptionCulprit": 1
        }
    }
}

Regarding licensing, the docs state that service principal "Doesn't require a Pro license. You can use content from any workspace that you're a member or an admin of." 

Considerations:

• My Power BI workspace is new, and is a "Power BI Premium Per User" workspace.
• The above results are from the unmodified sample app. The only change I have made is populating appsettings.json with my app's Azure AD credentials: ClientId (ApplicationId), TenantId and ClientSecret. I have also populated the WorkspaceId and ReportId with the appropriate values from my Power BI workspace.
• I am using an application secret, not a certificate. The docs and sample app support this as a viable option.
• I have added the service principal to an Azure AD security group, and I have added that group as a workspace member to the Power BI workspace specified in my appsettings.json.
• I have enabled the switch in the admin portal of Power BI to allow service principals to use Power BI APIs.
• (not sure if this matters) my app has an application role for Power BI Service. I have granted it "Tenant.Read.All". The only other option when adding in Azure AD UI is "Tenant.ReadWrite.All" which doesn't seem necessary as the sample app is effectively read-only.
• The server side of my app is able to get the access token and embed data successfully in its /embed-info endpoint. The issue is present only on the client-side.

I am already able to get master user to work both locally and on our production environment. However, I have had no success with service principal on either so any guidance would be appreciated.

Please don't hesitate to let me know if I should supply any more information or if anything is unclear!