User Profile
ejk0226
Regular Visitor
Joined 10 months ago
User Widgets
Contributions
Re: Embed for your Organization (User Owns Data) - C#, Forbidden, Invalid Token
I discussed with MS Support. If your org uses AzureAD such as https://login.microsoftonline.com and https://portal.azure.com/ but uses Power BI Gov GCC (API endoint https://api.powerbigov.us) then the scopes must be in https://analysis.usgovcloudapi.net. The primary problem was registring that API Permission within the Entra app registration. The trick to doing this is when adding the Request API Permission you must select "APIs my organization uses". Then realize that search is not a wild card search so you can't just search for Gov or Power. You have to locate the "Microsoft Power BI Government Community Cloud". That's it. Within app I only switched scopes such as https://analysis.usgovcloudapi.net/powerbi/api/Workspace.Read.All and it works. AzureAD is https://login.microsoftonline.com and Power BI endpoint is https://analysis.usgovcloudapi.net.Embed for your Organization (User Owns Data) - C#, Forbidden, Invalid Token
I’m getting a 403 Forbidden response. The response header X-PowerBI-Error-Info reports InvalidToken. I’ve tried various asp.net core code samples. Entra app registration api permission has delegated authority configured for Power Bi Services. The web app C# configures services like so: services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) .AddMicrosoftIdentityWebApp(configuration, "AzureAd") .EnableTokenAcquisitionToCallDownstreamApi(configuration.GetSection("PowerBi:RequiredScopes").Get<string[]>()) .AddInMemoryTokenCaches(); The C# call: var httpClientFactory = _httpClientFactory; // from Dependancy Injection; var tokenAcquisition = _tokenAcquisition; // from Dependancy Injection string[] scopes = { "https://analysis.windows.net/powerbi/api/Workspace.Read.All", "https://analysis.windows.net/powerbi/api/Dashboard.Read.All", "https://analysis.windows.net/powerbi/api/Report.Read.All", "https://analysis.windows.net/powerbi/api/PaginatedReport.Read.All" }; var accessToken = await tokenAcquisition.GetAccessTokenForUserAsync(scopes); var client = httpClientFactory.CreateClient(); client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken); var response = await client.GetAsync("https://api.powerbigov.us/v1.0/myorg/reports"); Is it the accessToken? What content within the token should I be looking at? The oid/name in the token is correct. "aud": "https://analysis.windows.net/powerbi/api" "scp": "Dashboard.Read.All PaginatedReport.Read.All Report.Read.All Workspace.Read.All" The Power BI admin says these are the Developer settings. My understanding is these settings relate to Embed for you Customer. I'm trying to use Embed for Org because all the users in my workspace will be intenal and they already have Power BI Pro licenses. I don't need/want to pay extra for capacity to support Embed for you Customer. Are there more Tenant settings I need to look for? Then I found some wording on https://learn.microsoft.com/en-us/rest/api/power-bi/#using-a-service-principal Does that mean either use Service Principal or Scopes but not both for the tentant? How exactly do I embed Power BI reports in C# web app such that there is no need to pay for extra capacity related to Embed for your Customer?
