Embedded - Accessing an external workspace

[RyanBentham]

I'm currently building a PBI embedded solution and hoping someone could share some experience please.

I'm using the 'app owns data' approach and currently connect to a number of workspaces within my tenants PBI service. All works great

I have demoed the solution to a customer I'm working with and they asked about the possibility of using their workspaces (that currently hold a number of their key reports and datasets) in combination with the embedded instance that is hosted in my tenant. Essentially they want to outsource the embedded side of it to me and not have it live within their azure environment 

So my question is, is it possible for me to connect and authenticate against a Customer's workspaces from my tenant's embedded capacity?   

If so, are you aware of any documentation or have any suggestions on implementing this?   Would my azure app need to be added as a guest to the customers workspace access etc?

Thanks 

[jaweher899]

Yes, it's possible to connect and authenticate against a customer's Power BI workspaces from your tenant's embedded capacity, but you need to make sure that your Azure app has been added as a guest to the customer's workspace with the necessary access.

To implement this, you can use the Power BI REST API to connect to the customer's workspaces and retrieve the necessary data. You will also need to implement an authentication mechanism, such as OAuth 2.0, to ensure that the customer's workspaces are accessed securely.

Here is some documentation that may be useful:

• Power BI REST API: https://docs.microsoft.com/en-us/rest/api/power-bi/
• Power BI Embedded Playground: https://aka.ms/pbembedplayground
• Power BI Embedded Samples: https://github.com/Microsoft/PowerBI-Developer-Samples

You can also find more information about Power BI Embedded and Azure Active Directory authentication in the following documentation:

• Power BI Embedded Authentication: https://docs.microsoft.com/en-us/power-bi/developer/embedded/authentication
• Azure Active Directory authentication for Power BI Embedded: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-to-tenant

[RyanBentham]

Thanks @jaweher899 

So in terms of connecting to the customer's workspaces via the Power BI REST API, my app should be added as a guest to the workspace/tenant, but how does the app then authenticate against the API?   Usually,  I do this via client credentials grant type using ID & Secret.  When auth be done some other way?   (or would i need the customer to provide client ids and secrets)?

Are you available for consultancy / freelance assistance? Please message me if so

Thanks

[jaweher899 · Accepted solution]

To connect to a customer's workspace via the Power BI REST API, your app would need to be added as a guest to the customer's tenant. Once the app has been added as a guest, you can use the OAuth 2.0 client credentials grant type for authentication. You would need to obtain the necessary client ID and secret from the customer's tenant. This information can be obtained from the Azure Active Directory in the customer's tenant, and is used to obtain an access token which is then used for making API requests. The customer would need to provide you with these credentials in order for your app to be able to access their workspace via the Power BI REST API.

[RyanBentham]

Much appreciated @jaweher899 

Am I right in saying that in order for the customer to provide me with the necessary client ID and secret, they would need to also create an app registration on their end?

So just to confirm, the flow would look something like this:

1)  My app added as a guest on the customer's tenant/workpsaces
2)  Customer sets up AOD app registration and provides me with the clients ID & secret

3)  I use this to generate an access token

4) The access token can then be used to generate the embed token for the workspace artifacts that my App has access to?

Thanks