Aad VS Embed token

[Renat]

Hello.

We have an angular app that embeds PowerBI report. There is a user in our Entra tenant with PowerBI Pro license. This user was used to obtain token and pass it to PowerBI service. Recently we had to enable MFA for that user and got a problem.

Previous code was like this (we can't use interactive auth flow due to business requirement).

Backend:

        public async Task<string> GetToken()
        {
            var formContent = new FormUrlEncodedContent(new[]
            {
                new KeyValuePair<string, string>("username", _username),
                new KeyValuePair<string, string>("password", _password),
                new KeyValuePair<string, string>("grant_type", "password"),
                new KeyValuePair<string, string>("resourse", _resourceUrl),
                new KeyValuePair<string, string>("client_id", _applicationId),
                new KeyValuePair<string, string>("scope", $"{_resourceUrl}/.default")
            });

            var myHttpClient = new HttpClient();
            var response = await myHttpClient.PostAsync($"{_authorityUrl}{_tenantId}/oauth2/v2.0/token", formContent);
            var stringContent = await response.Content.ReadAsStringAsync();
            var json = JsonConvert.DeserializeObject<AuthenticationResponse>(stringContent);
            if (json == null) json = new AuthenticationResponse();
            string access_token = json.access_token;
            return access_token;
        }

Frontend:

        let config: pbi.IEmbedConfiguration = {
            type: 'report',
            tokenType: pbi.models.TokenType.Aad,
            accessToken: token,
...
        };

After MFA has been enabled PowerBI stopped working and we have updated to following. Backend:

        private async Task<string> GetAadToken()
        {
            var cca = ConfidentialClientApplicationBuilder
                .Create(_applicationId)
                .WithClientSecret(_secret)
                .WithTenantId(_tenantId)
                .Build();

            var scopes = new string[] { $"{_resourceUrl}/.default" };
            var authResult = await cca.AcquireTokenForClient(scopes).ExecuteAsync();

            return authResult.AccessToken;
        }

        public async Task<string> GetPowerBIToken(Guid workspaceId, Guid reportId)
        {
            var tokenCredentials = new TokenCredentials(await GetAadToken());
            var client = new PowerBIClient(new Uri(_apiUrl), tokenCredentials);
            var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel: TokenAccessLevel.View);
            var tokenResponse = await client.Reports.GenerateTokenInGroupAsync(workspaceId, reportId, generateTokenRequestParameters);
            return tokenResponse.Token;
        }

 Frontend:

        let config: pbi.IEmbedConfiguration = {
            type: 'report',
            tokenType: pbi.models.TokenType.Embed, <========= Aad was changed to Embed
            accessToken: token,
...
        };

And now, when rendering PowerBI report there is a popup:

We have investigated it and figured out that now we need a capacity thay is way more expensive than PowerBI Pro license.

So, question is if there is any way to use non-interactive auth flow and get an AAD (not Embed) token that can be used to embed PowerBI.

Thanks!

[Anonymous]

Hi @Renat

Based on your question, you want to obtain an AAD (Azure Active Directory) token for an app embedded in Power BI without using the interactive login interface.

This approach is often called "embed for your customers" and uses a non-interactive authentication flow. In this scenario, users do not need a Microsoft Entra ID to access Power BI.

Instead, your web app uses a reserved Microsoft Entra identity to authenticate to the Microsoft Entra ID and generate an embedded token.

To implement this scenario, you need the following steps:

Register your web app in the Azure portal and get your app's client ID and client secret.

Register your web app with the Power BI service and get the app's workspace ID and report ID.

In your web app, use the client ID and client secret to request an access token from Azure AD for accessing the Power BI API.

Using the access token, request an embed token from the Power BI API for embedding the Power BI report.

Embed Power BI reports into your web app using embed tokens.

You can view the link below for more details:

c# - How to generate Azure Active Directory (AAD) authentication token for Graph API without interac...

How to acquire access tokens non-interactively for Azure Active Directory using username and passwor...

Permission tokens needed to embed a Power BI app - Power BI | Microsoft Learn

Get Azure AD access token without client secret, username/password for Power BI from Angular - Stack...

Regards, 

Nono Chen 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly. 

[Renat]

Hi

Thanks for reply. This is exactly what we have implemented and as I mentioned in original post we got this popup:

Our concern right now is that cheapest capacity cost is 750 USD/month while for "Pro license per user" we pay around $20 if I remember correctly.