Forum Discussion
Disabling multi factor authentication for power bi
Hi piper ,
The request requires the user to do multi-factor authentication and then send this new token back to Web API 1 and complete the on-behalf-of flow. MFA was enabled by triggering a rule if some action (e.g. sudden location change) was treated as "risky activity". For an account there is a "moved to a new location" flag that can get set, automatically triggering the need for MFA, even if it was initially off.
Please check the conditional access locations in Azure AD and check if your AAD admin can clear the flag. Disable MFA for the account or configure conditional access to give access to "Global Admin" role.
Please find additional info in the following articles:
https://docs.microsoft.com/en-us/azure/active-directory/develop/conditional-access-dev-guide
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Best Regards,
Dedmon Dai
maybe you can use a Service Principal to use with automating things around the REST API?
https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal
Thanks nickyvv for your response.
Currently, for every new client, we are creating new workspace/group via REST apis. This is required to clone reports to entirely new workspace dedicated for a client.
There are few limitations for using service principal, which are provided on same link which you have shared, like following one:
"Embed for your organization applications can't use service principal."
I am not sure, but with this, I think I won't be able to generate embed token for reports.
I had tried service principal approach in past for powerbi rest api, before going for powerBi pro, and it hadn't work earlier.
I will try it again, and update back.
Meanwhile, do you think if there is any way to either disable MFA or get access token silently with MFA?
Hi piper ,
The request requires the user to do multi-factor authentication and then send this new token back to Web API 1 and complete the on-behalf-of flow. MFA was enabled by triggering a rule if some action (e.g. sudden location change) was treated as "risky activity". For an account there is a "moved to a new location" flag that can get set, automatically triggering the need for MFA, even if it was initially off.
Please check the conditional access locations in Azure AD and check if your AAD admin can clear the flag. Disable MFA for the account or configure conditional access to give access to "Global Admin" role.
Please find additional info in the following articles:
https://docs.microsoft.com/en-us/azure/active-directory/develop/conditional-access-dev-guide
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Best Regards,
Dedmon Dai
Thanks v-deddai1-msft .
I have followed steps outlined here :https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide#manage-security-defaults
And, have disabled default security measures. I understand this is bit risky as per security, but it has unblocked me for now.
I was able to get access token for powerbi rest api.
Once POC completes, I will go through shared links in detail, to setup conditional access.
Hi piper ,
If my post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Best Regards,
Dedmon Dai