Forum Discussion

MurugeshPeurmal's avatar
MurugeshPeurmal
New Member
6 days ago

Error while retrieving Embed URL: Unauthorized: 401

For powerbi embedded, we created service principal in Microsoft Entra (Azure portal):

 

For which we need to provided it required PowerBi services - Report.ReadAll, Tenant.ReadAll

 

In our Fabric workspace we added this service principal as admin via manage access so that it can access workspace.

 

Till here its done and is active.

 

Now from our code we did following below steps:

 

1. Get access token from Microsoft entra for service principal - success

 

2. Generate token for the report inside the workspace - every time fails here with different methods

Need Help

4 Replies

  • v-achippa's avatar
    v-achippa
    Community Support
    6 days ago

    Hi MurugeshPeurmal,

     

    Thank you for reaching out to Microsoft Fabric Community.

     

    Since the service principal is successfully getting the entra access token, the authentication is working correctly. The issue is most likely with the power bi or fabric configuration required to generate the embed token.

    • Please verify that Service principals can use Fabric APIs is enabled in the fabric admin portal with a security group that includes your service principal.
    • Check if the service principal has access to both the report and its underlying semantic model (dataset).
    • Also verify that your token is requested for the power bi resource (https://analysis.windows.net/powerbi/api/.default), as token for the wrong audience also returns 401 error.

    If these settings are already correct, please share the exact error response returned by the generate token API

     

    Thanks and regards,

    Anjan Kumar Chippa

  • v-achippa's avatar
    v-achippa
    Community Support
    3 days ago

    Hi MurugeshPeurmal​,

    As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked?  or let us know if you need any further assistance.

    Thanks and regards,
    Anjan Kumar Chippa

    • v-achippa's avatar
      v-achippa
      Community Support
      9 hours ago

      Hi MurugeshPeurmal​,

      We wanted to kindly follow up to check if the solution I have provided for the issue worked?  or let us know if you need any further assistance.

      Thanks and regards,
      Anjan Kumar Chippa

  • ShivekMaharaj's avatar
    ShivekMaharaj
    Impactful Individual
    3 days ago

    Hi MurugeshPeurmal​,

    One thing I would check before adding any more Power BI API permissions to the Entra app.

    For a service-principal / app-owns-data scenario, Microsoft's current service principal embedding guidance actually says the Entra application does not need delegated or application Power BI permissions. Microsoft recommends avoiding them because they aren't used for service principal authorization and can make troubleshooting harder.

    So Report.Read.All / Tenant.Read.All aren't what grants the service principal access to this report. The important pieces are:

    • Embed content in apps enabled in the tenant settings
    • service-principal Power BI/Fabric API access enabled for the security group containing your service principal
    • the service principal or that security group added to the workspace as Member/Admin


    Since you already have the service principal as workspace Admin, I would verify the tenant-setting/security-group scope next.

    I would also isolate the 401 before troubleshooting the GenerateToken payload. Using the same Entra access token, try a simple call such as:

    GET https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/reports/{reportId}

    If that returns 401 as well, the problem is earlier in the authentication/authorization path. If it succeeds but GenerateToken fails, then you have narrowed it specifically to embed-token generation.

    Finally, make sure the client-credentials token is being requested for:

    https://analysis.windows.net/powerbi/api/.default

    and, if possible, decode the token and confirm the audience is the Power BI API.

    If you share the exact GenerateToken endpoint, request body, and the 401 response body after that test, it should be possible to narrow this down further.