PowerBINotLicensedException - Service Principal with "embed for your customers" sample app?

[rcvink]

Hi all,

Recently built an app using the "embed for your customers" ASP.NET Core sample app (Microsoft Tutorial). I'm hoping to use service principal authentication instead of master user, as it seems service principal is recommended for a production-quality embedding solution. I followed all of the applicable steps in the tutorial, and in this guide specifically for service principal too.

The issue we're seeing is that the sample app always displays the following for the iframe:

In the Dev Tools, I can see that the app is sending GET requests to this endpoint:

https://wabi-north-europe-redirect.analysis.windows.net/explore/reports/<my-report-id>/modelsAndExpl...

And the response is always a 401 Unauthorized with this body:

{
    "error": {
        "code": "PowerBINotLicensedException",
        "pbi.error": {
            "code": "PowerBINotLicensedException",
            "parameters": {},
            "details": [],
            "exceptionCulprit": 1
        }
    }
}

Regarding licensing, the docs state that service principal "Doesn't require a Pro license. You can use content from any workspace that you're a member or an ad..." 

Considerations:

• My Power BI workspace is new, and is a "Power BI Premium Per User" workspace.
• The above results are from the unmodified sample app. The only change I have made is populating appsettings.json with my app's Azure AD credentials: ClientId (ApplicationId), TenantId and ClientSecret. I have also populated the WorkspaceId and ReportId with the appropriate values from my Power BI workspace.
• I am using an application secret, not a certificate. The docs and sample app support this as a viable option.
• I have added the service principal to an Azure AD security group, and I have added that group as a workspace member to the Power BI workspace specified in my appsettings.json.
• I have enabled the switch in the admin portal of Power BI to allow service principals to use Power BI APIs.
• (not sure if this matters) my app has an application role for Power BI Service. I have granted it "Tenant.Read.All". The only other option when adding in Azure AD UI is "Tenant.ReadWrite.All" which doesn't seem necessary as the sample app is effectively read-only.
• The server side of my app is able to get the access token and embed data successfully in its /embed-info endpoint. The issue is present only on the client-side.

I am already able to get master user to work both locally and on our production environment. However, I have had no success with service principal on either so any guidance would be appreciated.

Please don't hesitate to let me know if I should supply any more information or if anything is unclear!

[rcvink]

Hi @Anonymous 

Thanks for your response. I can confirm that service principal does work if I set the workspace licence mode to 'Pro'.

Unfortunately we're hoping to use certain features that aren't included in Pro, for example Deployment Pipelines, and Dataflows.

Would it be correct to therefore say I must use master user authentication if I want to point at a Premium Per User workspace?

Would it be any different in 'Embedded' license mode (as seen in your screenshot)? Like would we be able to use Service Principal authentication?

I'll accept your response as the solution.

[Anonymous · Accepted solution]

Hi @rcvink ,

Currently service principals are not supported in PPU, you can find this official documentation for the details. You can select the related workspace and choose "Workspace settings" to revert to Pro mode if there is no feature of PPU be involved in this workspace, then check whether it can work normally....

Best Regards