Issue with Power BI API Permissions for Reports and Datasets when Generating Embed Token

Hi Anonymous .

Your issue is due to application permissions not including Report.Read.All and Dataset.Read.All, as these exist only under delegated permissions. Since you're using App-Only authentication, follow these steps:

1. Enable Service Principal Access in Power BI

   • Go to Power BI Admin Portal → Tenant Settings
   • Enable “Allow service principals to use Power BI APIs”. Assign a Security Group

2. Grant Workspace-Level Access: Add your Service Principal (App ID) as an Admin or Member in the Power BI Workspace

3. Use Client Credentials Flow for Authentication: Ensure your OAuth token request uses client_credentials and resource=https://analysis.windows.net/powerbi/api

4. Correct API Permissions in Azure AD

   • Assign only application permissions:
     • Dataset.ReadWrite.All
     • Report.Read.All
     • Workspace.ReadWrite.All
   • Grant Admin Consent

5. Generate Embed Token Using API

   1. POST https://api.powerbi.com/v1.0/myorg/reports/{reportId}/GenerateToken
      Authorization: Bearer {access_token}
      Content-Type: application/json
      
      {
        "accessLevel": "View",
        "identities": []
      }