Forum Discussion

juwonp's avatar
juwonp
New Member
1 year ago
Solved

Operation returned an invalid status code 'Forbidden'

I have .net8 blazor web application and tring to embed Power BI report.  

 

I'm trying to access Power BI report using Service Principal.

I can get to GetReportInGroup() but returns "Operation returned an invalid status code 'Forbidden'" error when trying to call GenerateTokenAsync(). 

It seems like the error happens when Power BI API is returning the report's access token.

 

It was working fine couple days ago, and now it is returning the error. 

 

I have the following licenses.

 

Any advice would be much appreciated!

 

Thanks,

Juwon

 

 

 

 

 

// Authenticate the service principal, and get an access token which will be used to authenticate the app's requests to Power BI REST API
public async Task<string> GetAdToken()
{
    var tenantId = _configuration["TenantId"];
    var clientId = _configuration["ClientId"];
    var clientSecret = _configuration["ClientSecret"];
    var authorityUri = new Uri($"https://login.microsoftonline.com/{tenantId}");

    var app = ConfidentialClientApplicationBuilder
                .Create(clientId)
                .WithClientSecret(clientSecret)
                .WithAuthority(authorityUri)
                .Build();

    var powerbiApiDefaultScope = "https://analysis.windows.net/powerbi/api/.default";
    var scopes = new string[] { powerbiApiDefaultScope };

    try
    {
        var authResult = await app.AcquireTokenForClient(scopes).ExecuteAsync();
        return authResult.AccessToken;
    }
    catch (Exception ex)
    {
        return ex.Message;
    }
}

// Retrieve the necessary info to embed a Power BI report in the app
public async Task<EmbeddedReportViewModel> GetReportEmbedding(string workspaceId, string reportId)
{
    string accessToken = await GetAdToken();

    // Create a Power BI client which will interact with Power BI's REST API
    var tokenCredentials = new TokenCredentials(accessToken, "Bearer");
    var urlPowerBiServiceApiRoot = "https://api.powerbi.com/";
    var pbiClient = new PowerBIClient(new Uri(urlPowerBiServiceApiRoot), tokenCredentials);

    // Fetch meta data for the desired Power BI report
    var workspaceIdGuid = new Guid(workspaceId);
    var reportIdGuid = new Guid(reportId);
    var report = pbiClient.Reports.GetReportInGroup(workspaceIdGuid, reportIdGuid);

    // Generate embed token which grants permission to view the report
    var tokenRequest = new GenerateTokenRequest(TokenAccessLevel.View, report.DatasetId);
    var embedTokenResponse = await pbiClient.Reports.GenerateTokenAsync(workspaceIdGuid, reportIdGuid, tokenRequest);

    var reportViewModel = new EmbeddedReportViewModel(
        report.Id.ToString(),
        report.Name,
        report.EmbedUrl,
        embedTokenResponse.Token
    );

    return reportViewModel;
}

 

 

 

 

 

  • juwonp's avatar
    juwonp
    1 year ago

    Sorry for the late reply.

     

    Creating new App Registration resolved the issue

     

    Thank you!

6 Replies

  • v-veshwara-msft's avatar
    v-veshwara-msft
    Community Support

    Hi juwonp ,

    Thanks for posting in the Microsoft Fabric Community.

    Facing "Operation returned an invalid status code 'Forbidden'" error when calling GenerateTokenAsync() in your Power BI embedding application often points to permission or configuration issues.
    A similar case was discussed in the community, where the problem was resolved by adjusting specific settings.
    Solved: Operation returned an invalid status code 'Forbidd... - Microsoft Fabric Community

    Ensure that "Embed content in apps" is enabled in the Power BI Admin Portal under Tenant settings, and that your service principal is part of an allowed security group.

    If the issue persists despite correct permissions, try recreating the service principal in Azure, as some users have resolved issues this way.

    The embed token’s validity depends on the Microsoft Entra (Azure AD) access token used to generate it. Always use a fresh access token before calling GenerateTokenAsync() to avoid expiration issues.
    Generate an embed token in Power BI embedded analytics - Power BI | Microsoft Learn

    Ensure that the required API permissions are granted with admin consent in Azure AD. Your app registration should include Power BI Service -> Application permissions, such as:

    1. Report.Read.All
    2. Dataset.Read.All
    3. Workspace.Read.All

    Additionally, ensure that the service principal has the necessary workspace access in Power BI. Navigate to Power BI Service -> Workspaces and verify that it is added as an Admin or Member of the workspace containing the report. Without the correct role, it may not have the required permissions to generate an embed token.

    For more details on authentication and API permissions, refer to:

    Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

    Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn


    Hope this helps. Please reach out for further assistance.

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and a kudos would be appreciated.

    Best Regards,
    Vinay.

     

    • juwonp's avatar
      juwonp
      New Member

      Sorry for the late reply.

       

      Creating new App Registration resolved the issue

       

      Thank you!

      • v-veshwara-msft's avatar
        v-veshwara-msft
        Community Support

        Hi juwonp ,
        Thanks for the update! Glad to hear that creating a new App Registration resolved the issue.

        If you found the provided information helpful, please consider accepting the solution, as it may assist others facing a similar issue. Please reach out if you need any further assistance.

         

        Thank you.

  • v-veshwara-msft's avatar
    v-veshwara-msft
    Community Support

    Hi juwonp ,

    Just following up on your issue to see if you’ve found a solution. If so, please mark the helpful reply as the Accepted Solution to assist others with similar issues. If you still need help, feel free to reach out for further assistance.

    Best regards,
    Vinay

  • v-veshwara-msft's avatar
    v-veshwara-msft
    Community Support

    Hi juwonp ,

    Just following up again regarding your issue. If your problem has been resolved, please mark the helpful reply as the Accepted Solution to assist others in the community.

    If you still need assistance, feel free to reach out.

    Looking forward to your response.

    Best regards,
    Vinay.

  • v-veshwara-msft's avatar
    v-veshwara-msft
    Community Support

    Hi juwonp ,
    We wanted to check in regarding your issue. If your problem has been resolved, please mark the helpful reply as the Accepted Solution to assist others in the community.

    If you still need assistance, feel free to reach out.

    Looking forward to your response.

    Best regards,
    Vinay.