I don't believe this is properly supported by Power BI at the moment, and the app-owns-data approach is the only way this can be accomplished.
Findings:
- Because the frontend could be signing in using ADAL with a client id that is different than the AAD Application where the Power BI app is hosted, errors will be given when attempting to get a power bi access token, advising that the user must be added to the tenant where Power BI resides.
- This works as expected if the users are all in the same directory -- but if your audience is in a different directory than your power BI subscription, we ran into errors.
- Even for the same directory configuration, you may have problems with if the user is a guest user. We added a guest user, put them in appropriate Power BI groups, but an InternalServerError was given when attempting to get a Power BI access token. Also noteworthy that PowerBI.com will not let you login with personal accounts -- it must be a work/organizational account, which is another reason why guest users may give you problems.
I hope someone from the Power BI team is able to explain how to accommodate B2B and B2C configurations using the end-user's bearer token, instead of the app-owns-data setup.
Best,
Alex
