"Could not load Edit mode: insufficient Permissions" editing Report with Service Principal Account

[jheising]

Hello! I'm trying to enable the ability to create and edit Power BI reports in an "App owns Data" scenario using a Service Principal account.

I don't seem to have any problem generating an embed token with the Reports GenerateTokenForCreateInGroup REST API Endpoint. My end user can create a report and save it just fine. I've checked in the Power BI portal and the Service Principal account seems to own the new report.

The problem comes when I try to allow that same user to come back and edit that report in the future. I'm calling the Reports GenerateTokenInGroup API endpoint with the following POST body:

{
    accessLevel: "Edit",
    allowSaveAs: true,
    datasetId: datasetID
}

When I go to use the resulting token in the powerbi-client javascript library using:

powerbi.embed(reportContainer, {
    type: "report",
    id: myReportID,
    accessToken: myEmbedToken,
    tokenType: powerBILib.models.TokenType.Embed,
    embedUrl: "https://embedded.powerbi.com/ReportEmbed",
    viewMode: powerBILib.models.ViewMode.Edit
});

I get an error that says "Could not load Edit mode: insufficient Permissions".

My App Registration permissions in the Azure portal are as follows:

Any ideas why I would be able to create a report with a Service Principal account but not edit it? Any help would be greatly appreciated!

[jheising · Accepted solution]

Figured it out. Apparently you have to set the permissions setting on the embed function on the client.

powerbi.embed(reportContainer, {
    type: "report",
    id: myReportID,
    accessToken: myEmbedToken,
    tokenType: powerBILib.models.TokenType.Embed,
    embedUrl: "https://embedded.powerbi.com/ReportEmbed",
    permissions: powerBILib.models.Permissions.All, // Must be included
    viewMode: powerBILib.models.ViewMode.Edit
});

[Greg_Deckler]

@dm-p