Embedding report in external app with non-Power BI users

Hi Eric.

Thanks for your answers.

1. The registered Azure APP doesn't have anything to do with Power BI reports except to get the accesstoken. If you want to embed your reports in an external application you have to publish it to PowerBI service,

Thanks for the info.

In the mean time, I also figured it out - the reason to register Azure AD app is to get Client ID.

I think that you should write about this in article Register an Azure AD app to embed Power BI content.

2.You could get the accesstoke and embedded token via two REST APIs as below.

--get the access token
POST /common/oauth2/token HTTP/1.1
Host: login.windows.net
Cache-Control: no-cache 
Content-Type: application/x-www-form-urlencoded

client_id=49dxxxxxxxthe register app client idxxxxx0-6d93f770d1a4&grant_type=password&resource=https%3A%2F%2Fanalysis.windows.net%2Fpowerbi%2Fapi&username=yourpowerbiaccount&password=yourpowerbipassword

--To get the embedded token for a report/dashboard/tile
--reference https://msdn.microsoft.com/en-us/library/mt784614.aspx

POST /v1.0/myorg/groups/dc5811-YOURGROUPID-f16b6c15/reports/16d21d5a-YOURreportID--46a2fd9/GenerateToken HTTP/1.1
Host: api.powerbi.com
Content-Type: application/json
Authorization: Bearer theTokenFromPriorAPI
Cache-Control: no-cache 

{
 "accessLevel": "View"
}

Thanks for informing that authorization code and access token are not the same. I read article Authenticate users and get an Azure AD access token for your Power BI app and I didn't notice the difference.

In the mean time, I found Microsoft Azure Active Directory Authentication Library (ADAL) for Java and it worked to get the authorization code. But I thought that this authorization code is an access token and tried to use it to embed my report using powerbi-client and it didn't work. Now I know that this wasn't an access code.

And with the API which you pointed it start to work.

Big thanks.

3. Yes, it needs a Premium licence if you want to use  Embedding with non-Power BI users (app owns data). For cost-saving, a more simpler approach would be using Publish to web, you don't have to apply option 1&2.

---

Publishing to web is not the option for us.

This is not working for me, i get errors on the first api call

{
    "error": "invalid_grant",
    "error_description": "AADSTS65001: The user or administrator has not consented to use the application with ID '3ae04a38-c62e-459b-89ad-894c0df9120f'. Send an interactive authorization request for this user and resource.\r\nTrace ID: 1ca981c2-722f-44e8-a6de-ea68d22c1d00\r\nCorrelation ID: c57e252f-d4e3-4bd6-a958-f56b3ff4386b\r\nTimestamp: 2017-08-04 14:14:49Z",
    "error_codes": [
        65001
    ],
    "timestamp": "2017-08-04 14:14:49Z",
    "trace_id": "1ca981c2-722f-44e8-a6de-ea68d22c1d00",
    "correlation_id": "c57e252f-d4e3-4bd6-a958-f56b3ff4386b"
}

The first api returns the AccessToken and the RefreshToken, everything works fine...

But, when i use the second API, to generate the Embed Token, i get this message:

{"error":{"code":"BadRequest","message":"Bad Request","details":[{"message":"'request' is a required parameter","target":"request"}]}}

My app is full permissions to the access token retrieved from the AzureAD, and the reportId/datasetId i got from:

$.ajax({
type: 'POST',
url: `https://api.powerbi.com/v1.0/myorg/groups/${this.groupId}/reports/${this.reportId}/GenerateToken`,
headers: {
"Content-Type": "application/json",
"Authorization": `Bearer ${this.authToken}`
},
body: {
"accessLevel": "View",
"datasetId": this.datasetId
},
success: (data) => {
console.log('ss', data)
},
error: (data) => {
console.log('rr', data)
}
});

Access Token is for quering API to which you have access. Embedded token is generated in API(when calling to generate embedded token you need to pass Access Token like to all restricted API) for just be able to embedded single dashboard or report.