Dynamic Token refresh for PBI Admin API calls not being accepted

I figured out the solution. For anyone who ever encounters the same issue, I'm laying it out clearly here as it is a little confusing, and the docs aren't clear about this:

If your organization has MFA enabled, then you either need to disable MFA or you cannot use your username/password to connect, so the grant_type = password cannot be used in this case. 

If you use grant_type = password and MFA is disabled, then you need to also make sure the app has Tenant.Read.All API permission enabled, to be able to connect. 

If you cannot disable MFA (which was the case for me as our org wouldn't allow that ofcourse), then using the grant_type = client_credentials is the way to go. You'll need to provide the client_id, client_secret, scope and tenant_id. But make sure to REMOVE Tenant.Read.All from the API permissions.

When using service principal, you CANNOT have Tenant.Read.All permissions allowed in the app reg. This was the problem for me. I didn't know about the MFA, so I had Tenant.Read.All permissions allowed but it still didn't work. Then once I tried with grant_type = client_credentials, it still wouldn't work because I needed to remove the Tenant.Read.All permissions for it to work. 

To summarize: 

• When connecting with grant_type = password, you need to disable MFA and have Tenant.Read.All permissions enabled in the API Permissions (which in my case was not an option).
• When connecting with grant_type = client_credentials, Tenant.Read.All must be disabled and provide client_id, client_secret, tenant_id and scope.