Forum Discussion
Access Tokens - Users from Multiple AAD Directories
Good afternoon,
We have Power BI set up on our primary company directory, company.com. We're able to get the access tokens and access the Power BI Embedded reports without issue, using authorized credentials from our directory.
However, we have a B2B use case where our partners live in another directory, that we own and manage. We add our partner users to the second directory as a Guest User.
With our web app, Power BI Embedded reports are being served up in a configuration where the app owns the data. However, we wish to use the access token from the logged in partner user, on the secondary directory, to serve up the Power BI report.
Question: How can I grant access to an AAD user of another directory to my AAD Application and Power BI Embedded reports on my company directory? We wish to avoid "app owns data" scenarios for the purpose of tightly controlling and logging access to our sensitive reports.
Thank you in advance.
3 Replies
I don't believe this is properly supported by Power BI at the moment, and the app-owns-data approach is the only way this can be accomplished.
Findings:- Because the frontend could be signing in using ADAL with a client id that is different than the AAD Application where the Power BI app is hosted, errors will be given when attempting to get a power bi access token, advising that the user must be added to the tenant where Power BI resides.
- This works as expected if the users are all in the same directory -- but if your audience is in a different directory than your power BI subscription, we ran into errors.
- Even for the same directory configuration, you may have problems with if the user is a guest user. We added a guest user, put them in appropriate Power BI groups, but an InternalServerError was given when attempting to get a Power BI access token. Also noteworthy that PowerBI.com will not let you login with personal accounts -- it must be a work/organizational account, which is another reason why guest users may give you problems.
I hope someone from the Power BI team is able to explain how to accommodate B2B and B2C configurations using the end-user's bearer token, instead of the app-owns-data setup.
Best,Alex
Please vote for support here:
Findings:
- Because the frontend could be signing in using ADAL with a client id that is different than the AAD Application where the Power BI app is hosted, errors will be given when attempting to get a power bi access token, advising that the user must be added to the tenant where Power BI resides.
- This works as expected if the users are all in the same directory -- but if your audience is in a different directory than your power BI subscription, we ran into errors.
- Even for the same directory configuration, you may have problems with if the user is a guest user. We added a guest user, put them in appropriate Power BI groups, but an InternalServerError was given when attempting to get a Power BI access token. Also noteworthy that PowerBI.com will not let you login with personal accounts -- it must be a work/organizational account, which is another reason why guest users may give you problems.
I hope someone from the Power BI team is able to explain how to accommodate B2B and B2C configurations using the end-user's bearer token, instead of the app-owns-data setup.Voted.
