Issue with Power BI API Permissions for Reports and Datasets when Generating Embed Token

[Datawake]

I am encountering an issue accessing the endpoints for reports and datasets in the Power BI API. My original goal is to generate the embed token using application permissions. However, upon investigating the access, I noticed that only the groups endpoint is accessible, while the reports and datasets endpoints do not appear.

I used JWT to decode the token I’m passing and saw that only the permissions roles: ["Tenant.ReadWrite.All", "Tenant.Read.All"] are being included in the token. According to the documentation, I need permissions for reports and datasets, but I added these permissions under ‘delegated permissions’ because they do not exist under ‘application permissions’. It seems the token only includes application permissions.

I have created the service in Azure and granted all the necessary permissions:

JSON

"scope": "UserDataFunction.Read.All Connection.ReadWrite.All Connection.Read.All UserState.ReadWrite.All Workspace.Read.All Workspace.ReadWrite.All Tenant.ReadWrite.All Dataset.ReadWrite.All Dataset.Read.All Dashboard.Read.All Tenant.Read.All App.Read.All Report.Execute.All Dashboard.Reshare.All Dashboard.ReadWrite.All Report.Read.All Report.ReadWrite.All Dashboard.Execute.All Workspace.GitCommit.All Workspace.GitUpdate.All"

Thank you for your assistance.

[rohit1991 · Accepted solution]

Hi @Datawake .

Your issue is due to application permissions not including Report.Read.All and Dataset.Read.All, as these exist only under delegated permissions. Since you're using App-Only authentication, follow these steps:

1. Enable Service Principal Access in Power BI

   • Go to Power BI Admin Portal → Tenant Settings
   • Enable “Allow service principals to use Power BI APIs”. Assign a Security Group

2. Grant Workspace-Level Access: Add your Service Principal (App ID) as an Admin or Member in the Power BI Workspace

3. Use Client Credentials Flow for Authentication: Ensure your OAuth token request uses client_credentials and resource=https://analysis.windows.net/powerbi/api

4. Correct API Permissions in Azure AD

   • Assign only application permissions:
     • Dataset.ReadWrite.All
     • Report.Read.All
     • Workspace.ReadWrite.All
   • Grant Admin Consent

5. Generate Embed Token Using API

   1. POST https://api.powerbi.com/v1.0/myorg/reports/{reportId}/GenerateToken
      Authorization: Bearer {access_token}
      Content-Type: application/json
      
      {
        "accessLevel": "View",
        "identities": []
      }
      

[Waldner]

Hi @rohit1991

I'm encountering a similar issue and tried following your advice.

In step 1, I see the option "Service principals can use Fabric APIs," but not "Allow service principals to use Power BI APIs." 

In step 4, the application permissions only show Tenant.Read.All and Tenant.ReadWrite.All.

I'm not sure what I'm missing here. Can you help please?

Thanks!

[pguth]

Did you ever figure this out? I'm having the exact same outcome as what you describe.

Thanks,

Philip

[Datawake]

Hi @rohit1991 ,

Thank you so much for your detailed instructions! I followed your steps, and it worked perfectly. I really appreciate your help.