Authenticate Power BI in ASP.NET Core Web API as service principal

[vers]

We are working on Power BI reports. The data is fetched once a day from an ASP.NET Core Web API we developed. OAuth2 was used as an authentication framework in the .NET Core application, which worked fine since it was tested with Swagger.

We want to authenticate Power BI in the .NET Core application. We don't want to embed Power BI in a web page. Our problem is authenticating Power BI requests in the .NET Core API endpoint. It can be done in various ways:

1. Basic authentication
2. Service Principal

Basic Authentication

Previously, the authentication was done with basic authentication (username and password), which worked fine. But now, we plan to make it more secure.

Service Principal

We think using the service principal is the right approach for our case. I assume that authentication with service principal in Power BI uses OAuth2 client credentials flow behind the scenes.

We configured the service principal in the Power BI Web app in the following way:

Power BI => Workspace => Semantic Model => Settings => Data Source Credentials => Edit Credentials

 

Also, we added app registration as a security group in Power BI with Admin permissions:

As you can see, the security group with app registration and, the app registration itself were added to the workspace with Admin permissions.

When we want to configure authentication for Power BI to access the ASP.NET Core Web API as a service principal, we get the following error:

Failed to update data source credentials.

How can we solve the problem of not being able to authenticate Power BI as a service principal in the ASP.NET Core Web API?

I assume we didn't provide enough info to Power BI, because Power BI doesn't ask for other info, like scope and URL for OAuth2 token. So, I didn't tell Power BI, that this is the URL where to generate a token:

https://login.microsoftonline.com/azure-tenant-guid/oauth2/v2.0/token

For OAuth2 the scope is also important, which is the following format: api://***********/.default

[Anonymous]

Hi, @vers 

Based on the error information you provided, the error code is 400, which usually indicates that the request is invalid. You may need to go into the Power BI admin portal first, make sure that the setting Allow service principals to use the Power BI APIs is enabled, and that the service principals are added to the workspace and have admin permissions. 

By the way, check whether the App registration is multi-tenant or single-tenant in the Azure portal, and generally choose the second one.

How to Get Your Question Answered Quickly

Best Regards

Yongkang Hua

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.