Authorization fails trying to invoke PowerBI Rest API from C# Function App

[joolzfawcett]

I am trying to implement a C# Azure Function App to use the PowerBI Rest API to extract information about workspaces etc in our tenant.

As a starting point I used Jeff Pries's excellent blog post:

https://blog.jpries.com/2020/01/03/getting-started-with-the-power-bi-api-querying-the-power-bi-rest-...

Initially I implemented this as a standalone local app and it worked fine. So I know that I have setup my App Registration correctly in the Azure AD and I know that I can successfully authorize non-interactively with saved User/Password credentials and obtain a list of PowerBI workspaces on our tenant.

However, when I came to implement this in an Azure Function App I found that the option to use User/Password isn't available, so instead am trying using a ClientSecret to authenticate, but cannot get it to work.

I am using AcquireTokenAsync method to get the auth token: 

authResult = await authContext.AcquireTokenAsync(ResourceURL, clientCredential).ConfigureAwait(false);

I know I am using the correct client secret because if I deliberately use the wrong one I get an "Invalid client secret is provided" exception. 

I then CreateAuthorizationHeader method to create the authorization header

authToken = authResult.Result.CreateAuthorizationHeader();

You can see from the console screenshot below that this all appears to work fine. I end up with a sound looking bearer token:

Then I create an HTTPClient and set the auth token in the Authorization header:

client = new HttpClient();

client.DefaultRequestHeaders.UserAgent.ParseAdd(HTTPHEADUSERAGENT);

client.DefaultRequestHeaders.Add("Authorization", authToken);

Finally, I try to use the client to call the PowerBI API:

string serviceURL ="https://api.powerbi.com/v1.0/myorg/groups";

response = client.GetAsync(serviceURL).Result;

Every time I get response code: Unauthorized.

What am I doing wrong?

The ResourceURL I am using to acqure the token is: "https://analysis.windows.net/powerbi/api".

I have tried using different versions of the Microsoft.IdentityModel.Clients.ActiveDirectory. I tried using the latest v5.2.8, but I have also seen posts which suggest the problem could be solved by using v3.19.8. But neither makes any difference.

The AuthorityURL I am using to get the auth context for v3.19.8 is: "https://login.windows.net/common/oauth2/authorize".

The AuthorityURL I am using to get the auth context for v5.2.8 was: "https://login.microsoftonline.com/common". I also tried using URLs that include our tenant id.

[v-shex-msft]

HI @joolzfawcett,

Maybe you can try to refer to the following document sample codes to replace the get token parts and test to confirm if this token works on your side.

Step 2: Get an authentication access token 

Please also take a look at the best practice of azure function if it helps:

Best practices for performance and reliability of Azure Functions 
Regards,

Xiaoxin Sheng