I'm trying to setup a Blazor application that embeds PowerBI reports into a page.
I've been following the [Embed Power BI content with service principal and an application secret tutorial](https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal?tabs=azure-por...) and I am able to setup the [App Owns Data](https://github.com/microsoft/PowerBI-Developer-Samples/tree/master/.NET%20Core/Embed%20for%20your%20...) example successfully.
Now I would like to publish this application so that an azure admin of another organization in Microsoft Entra can authorize the application and embed one of his reports. Eventually, the user wouldn't have to be signed in, and can delegate a different user (not in his Microsoft Org, but inside the application) to view a report, so I need to authorize the
*application* ( to manage PowerBI data without a signed in user.
There's an example for this use case [here](https://github.com/Azure-Samples/ms-identity-aspnet-daemon-webapp) in .Net Framework. I've also seen the linked examples on that Readme [here](https://github.com/Azure-Samples/active-directory-dotnetcore-daemon-v2) for .Net Core, but all of these examples require a manual user process of creating the service principal in Microsoft Entra, and authorizing that Service Principal in PowerBI.
I was able to register an application in Microsoft Entra (through App Registrations), and was also able to sign into my application as a user from another organization. This creates an "Enterprise Application" inside the user's tenant. Now, when I try to get a token for PowerBI using the clientId of my application, I get an "Unauthorized" message.
Here's the relevant code in my application:
appsettings.json
```json
{
"AzureAd": {
"AuthorityUrl": "https://login.microsoftonline.com/organizations/",
"Instance": "https://login.microsoftonline.com/",
"Domain": "<domain>", // this is the domain where I registered my app
"ClientId": "<clientId>", // this is the clientId of the registered app
"TenantId": "organizations",
"ScopeBase": ["https://analysis.windows.net/powerbi/api/.default"],
"ClientSecret": "<secret>", // this is the secret I've added to the registered app
"CallbackPath": "/signin-oidc"
},
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.AspNetCore": "Warning"
}
},
"AllowedHosts": "*"
}
```
```csharp
WebApplicationBuilder? builder = WebApplication.CreateBuilder(args);
builder.Services.Configure<AzureAd>(config.GetSection(key: nameof(AzureAd)));
builder
.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(config);
builder
.Services.AddRazorComponents()
.AddInteractiveServerComponents()
.AddMicrosoftIdentityConsentHandler();
builder.Services
.AddControllersWithViews()
.AddMicrosoftIdentityUI();
```
I then add the `[Authorize]` attribute to my Blazor component, so when the user tries to access that page, they are prompted to authorize the app. This is where the "Enterprise Application" gets created in the user's tenant in Microsoft Entra. It looks like this successfully creates a service principal, since I can go to PowerBI and add this service principal as an admin of his PowerBI workspace.
However, when I try to generate a token for it:
```csharp
IOptions<AzureAd> options = services.GetRequiredService<IOptions<AzureAd>>();
string tenantSpecificUrl = options.Value.AuthorityUrl?.Replace("organizations", "<MyClientId>") ?? string.Empty;
var clientApp = ConfidentialClientApplicationBuilder
.Create(options.Value?.ClientId)
.WithClientSecret(options.Value?.ClientSecret)
.WithAuthority(tenantSpecificUrl)
.Build();
AuthenticationResult authenticationResult = clientApp
.AcquireTokenForClient(options.Value?.ScopeBase)
.ExecuteAsync()
.Result;
string token = authenticationResult.AccessToken;
TokenCredentials tokenCredentials = new(token, "Bearer");
var powerBIClient = new PowerBIClient(new Uri("https://api.powerbi.com"), tokenCredentials);
var groups = await powerBIClient.Groups.GetGroupsAsync();
```
I get an Unauthorized message.
I do believe there's something fundamentally wrong with the way I'm doing this, but I cannot find any examples of automatically creating a service principal anywhere.
Any help is much appreciated!
