Operation returned an invalid status code 'Forbidden'

[juwonp]

I have .net8 blazor web application and tring to embed Power BI report.  

I'm trying to access Power BI report using Service Principal.

I can get to GetReportInGroup() but returns "Operation returned an invalid status code 'Forbidden'" error when trying to call GenerateTokenAsync(). 

It seems like the error happens when Power BI API is returning the report's access token.

It was working fine couple days ago, and now it is returning the error. 

I have the following licenses.

Any advice would be much appreciated!

Thanks,

Juwon

// Authenticate the service principal, and get an access token which will be used to authenticate the app's requests to Power BI REST API
public async Task<string> GetAdToken()
{
    var tenantId = _configuration["TenantId"];
    var clientId = _configuration["ClientId"];
    var clientSecret = _configuration["ClientSecret"];
    var authorityUri = new Uri($"https://login.microsoftonline.com/{tenantId}");

    var app = ConfidentialClientApplicationBuilder
                .Create(clientId)
                .WithClientSecret(clientSecret)
                .WithAuthority(authorityUri)
                .Build();

    var powerbiApiDefaultScope = "https://analysis.windows.net/powerbi/api/.default";
    var scopes = new string[] { powerbiApiDefaultScope };

    try
    {
        var authResult = await app.AcquireTokenForClient(scopes).ExecuteAsync();
        return authResult.AccessToken;
    }
    catch (Exception ex)
    {
        return ex.Message;
    }
}

// Retrieve the necessary info to embed a Power BI report in the app
public async Task<EmbeddedReportViewModel> GetReportEmbedding(string workspaceId, string reportId)
{
    string accessToken = await GetAdToken();

    // Create a Power BI client which will interact with Power BI's REST API
    var tokenCredentials = new TokenCredentials(accessToken, "Bearer");
    var urlPowerBiServiceApiRoot = "https://api.powerbi.com/";
    var pbiClient = new PowerBIClient(new Uri(urlPowerBiServiceApiRoot), tokenCredentials);

    // Fetch meta data for the desired Power BI report
    var workspaceIdGuid = new Guid(workspaceId);
    var reportIdGuid = new Guid(reportId);
    var report = pbiClient.Reports.GetReportInGroup(workspaceIdGuid, reportIdGuid);

    // Generate embed token which grants permission to view the report
    var tokenRequest = new GenerateTokenRequest(TokenAccessLevel.View, report.DatasetId);
    var embedTokenResponse = await pbiClient.Reports.GenerateTokenAsync(workspaceIdGuid, reportIdGuid, tokenRequest);

    var reportViewModel = new EmbeddedReportViewModel(
        report.Id.ToString(),
        report.Name,
        report.EmbedUrl,
        embedTokenResponse.Token
    );

    return reportViewModel;
}

[v-veshwara-msft]

Hi @juwonp ,
We wanted to check in regarding your issue. If your problem has been resolved, please mark the helpful reply as the Accepted Solution to assist others in the community.

If you still need assistance, feel free to reach out.

Looking forward to your response.

Best regards,
Vinay.

[v-veshwara-msft]

Hi @juwonp ,

Just following up again regarding your issue. If your problem has been resolved, please mark the helpful reply as the Accepted Solution to assist others in the community.

If you still need assistance, feel free to reach out.

Looking forward to your response.

Best regards,
Vinay.

[v-veshwara-msft]

Hi @juwonp ,

Just following up on your issue to see if you’ve found a solution. If so, please mark the helpful reply as the Accepted Solution to assist others with similar issues. If you still need help, feel free to reach out for further assistance.

Best regards,
Vinay

[v-veshwara-msft]

Hi @juwonp ,

Thanks for posting in the Microsoft Fabric Community.

Facing "Operation returned an invalid status code 'Forbidden'" error when calling GenerateTokenAsync() in your Power BI embedding application often points to permission or configuration issues.
A similar case was discussed in the community, where the problem was resolved by adjusting specific settings.
Solved: Operation returned an invalid status code 'Forbidd... - Microsoft Fabric Community

Ensure that "Embed content in apps" is enabled in the Power BI Admin Portal under Tenant settings, and that your service principal is part of an allowed security group.

If the issue persists despite correct permissions, try recreating the service principal in Azure, as some users have resolved issues this way.

The embed token’s validity depends on the Microsoft Entra (Azure AD) access token used to generate it. Always use a fresh access token before calling GenerateTokenAsync() to avoid expiration issues.
Generate an embed token in Power BI embedded analytics - Power BI | Microsoft Learn

Ensure that the required API permissions are granted with admin consent in Azure AD. Your app registration should include Power BI Service -> Application permissions, such as:

1. Report.Read.All
2. Dataset.Read.All
3. Workspace.Read.All

Additionally, ensure that the service principal has the necessary workspace access in Power BI. Navigate to Power BI Service -> Workspaces and verify that it is added as an Admin or Member of the workspace containing the report. Without the correct role, it may not have the required permissions to generate an embed token.

For more details on authentication and API permissions, refer to:

Embed Power BI content in an embedded analytics application with service principal and an applicatio...

Embed Power BI content in an embedded analytics application with service principal and an applicatio...

Hope this helps. Please reach out for further assistance.

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and a kudos would be appreciated.

Best Regards,
Vinay.

[juwonp · Accepted solution]

Sorry for the late reply.

Creating new App Registration resolved the issue

Thank you!

[v-veshwara-msft]

Hi @juwonp ,
Thanks for the update! Glad to hear that creating a new App Registration resolved the issue.

If you found the provided information helpful, please consider accepting the solution, as it may assist others facing a similar issue. Please reach out if you need any further assistance.

Thank you.