Okay here we go. I hope this will help others trying who are trying to use Power BI Embedded (A skus) with Service Principal authentication to Embed for your Customers. Here are the steps I took to get to my problem, but the problem is in bold at the bottom if you want to skip ahead. If anyone can help me I will buy them a coffee. Seriously.
I have been struggling to get Power BI Embedded set up, starting with an A1 sku. My setup is to embed for customers using a service principal. The main resource I am using for the initial setup is https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-sample-for-customers?tabs=net-co....
I have finished every step at the link above using a service principal. After downloading the sample project in step 8, I am able to run the .NET core app with my service principal and see the sample report in my Power BI workspace. I also modified the sample report to make sure it is working correctly. That is rad, but displayed above the report is the "This is a free trial version, to remove this label a capacity must be purchased." No problem, let's check docs for the next step, Moving to Production.
Okay I need to assign my workspace to a capacity. Since I am using a Service Principal I need to use the Power BI Rest API, specifically this endpoint AssignToCapacity. For that I need my WorkspaceId and CapacityId. I found the WorkspaceId by opening app.powerbi.com to my workspace, and checking the URL for the guid. Alternatively I could have used the Groups API. Unfortunately that API link does not mention the authentication needed. To authenticate to that API you need to pass a Bearer token in the header. To get the token, make a GET request to https://login.microsoftonline.com/{{your_tenantId_here}}/oauth2/v2.0/token/. For the content type use "application/x-www-form-urlencoded". In the body make sure to pass:
- grant_type = client_credentials
- scope = https%3A%2F%2Fanalysis.windows.net%2Fpowerbi%2Fapi%2F.default
- client_id = {{your_servicePrinicpal_clientId_here}}
- client_secret = {{your_servicePrinicpal_clientSecret_here}}
Now for the CapacityId, I opened my Power BI Embedded A1 resource in the Azure portal. Okay it's not in the Overview, so I will check Properties. Nope, not there either. After some sleuthing I found that the only way to get the CapacityId is by calling this API. I know how to get the auth token, so I grab that and call the API. Here is my actual current problem: When the Get Capacities response is returned there is only one value, and it is a "Premium Per User - Reserved" capacity with a sku of "PP3". My A1 sku is nowhere to be found. I followed all the steps, and all the permissions *should* be setup correctly. The capacity is not paused, and the status is active. The resource mode is Generation 2. Does anyone know common reasons why my A1 sku is not being returned when calling this API?
EDIT2: I managed to get a proper V1 AAD token using the following request body params. Note that I needed to change scope from the V2 call to resource.
- grant_type=client_credentials
- resource=https://management.azure.com/
- client_id={{your_servicePrinicpal_clientId_here}}
- client_secret={{your_servicePrinicpal_clientSecret_here}}
Now I am running into a permission error with the Capacity API call. "The client '{guid}' with object id '{guid}' does not have authorization to perform action 'Microsoft.PowerBIDedicated/capacities/read' over scope '/subscriptions/{guid}/resourceGroups/{resourceName}/providers/Microsoft.PowerBIDedicated/capacities/{capacityName}' or the scope is invalid. If access was recently granted, please refresh your credentials." Now to figure out how to set the required permission...
My next steps (In case anyone has any hints or tips):
- After I manage to get the CapacityId I will make the API call to AssignToCapacity, and hope it works. The next time I run the sample app, the "free trial version" banner should be gone.
- Then I need to install an On-Premises gateway because we will be using data from our internal network.
- After the gateway is installed an configured, I will publish a report/dashboard and a dataset that uses our OnPrem data.
- Then I will test to make sure the published report is working with the gateway.
- Then I will finally be able to use the Power BI SDK to generate EmbedTokens and EmbedUrls server side, and then send them to my client.
Rants and Raves (Not important, but maybe someone will commiserate with me):
- The documentation for Power BI Embedded is incomplete and spread out all over the place. I learned almost as much from scouring these forums as I have from the documentation. Thank you forum members, moderators, and the like.
- Apparently workspaces are groups and groups are workspaces. Not confusing at all Microsoft.
- Why is the CapacityId not listed on my Power BI Embedded A1 resource in the Azure portal? Security reasons?
- The Power BI API link is mildly infuriating: https://api.powerbi.com/v1.0/myorg/capacities. Did anyone else spend 30 minutes trying to figure out what to replace the "myorg" segment with? Hint: you don't. It's quite possible I am just dense.
- For a service that costs at minimum over $700 a month, assuming the capacity is not being paused, the setup should not be this difficult.
