Forum Discussion

AlexJH's avatar
AlexJH
New Member
8 years ago

Access Tokens - Users from Multiple AAD Directories

Good afternoon,   We have Power BI set up on our primary company directory, company.com.  We're able to get the access tokens and access the Power BI Embedded reports without issue, using authorize...
AlexJH's avatar
AlexJH
New Member
8 years ago

I don't believe this is properly supported by Power BI at the moment, and the app-owns-data approach is the only way this can be accomplished.


Findings:

  • Because the frontend could be signing in using ADAL with a client id that is different than the AAD Application where the Power BI app is hosted, errors will be given when attempting to get a power bi access token, advising that the user must be added to the tenant where Power BI resides.
  • This works as expected if the users are all in the same directory -- but if your audience is in a different directory than your power BI subscription, we ran into errors.
  • Even for the same directory configuration, you may have problems with if the user is a guest user. We added a guest user, put them in appropriate Power BI groups, but an InternalServerError was given when attempting to get a Power BI access token. Also noteworthy that PowerBI.com will not let you login with personal accounts -- it must be a work/organizational account, which is another reason why guest users may give you problems.


I hope someone from the Power BI team is able to explain how to accommodate B2B and B2C configurations using the end-user's bearer token, instead of the app-owns-data setup.


Best,

Alex