Embedding report in external app with non-Power BI users

[mda]

Hi,

I'm trying to embed a report in an external application.

To do this I performed all steps described in How to embed your Power BI dashboards, reports and tiles.

App registration was done in our existing corporate Azure Active Directory tenant as described in this article: Register an Azure AD app to embed Power BI content. Also, our administrator made me an Owner of this App, and I, of course, have a Power BI Pro account.

After that, I've tried to generate the access token, but I'm not sure how to do this. In article Authenticate users and get an Azure AD access token for your Power BI app code is written in C#, but in our external app we will use Java and JavaScript, so I need to generate it in another way. For me, it looks like series of HTTP request. Can you give me a description of protocol using which I can obtain access token?

This was the first question. But even if I know access token, I'm not sure how I have to publish my report to App registered with Azure. In the article Register an Azure AD app to embed Power BI content there is written that I have to create app workspace on Power app.powerbi.com. But there is no word how it should be linked with App registered in Azure Active Directory.

And in all those articles there is no word how to publish reports. Of course, when I publish a report from Desktop I can choose app workspace, but it will be available only on app.powerbi.com. So I think that if I want to embed my report in an external application I have to publish it to Azure App not to PowerBI App, right?

And the last question - now we are only trying the abilities of embedding reports in an external application and we don't have Premium. Do we need it for evaluation?

I will be very thankful for detailed answers for each of my question.

[d_u_a]

In this scenario why we're creating accessToken ? We will use only embedToken to embedding our reports ? If accessToken is necessery how we will use this token in app ?

[pzielinski]

Access Token is for quering API to which you have access. Embedded token is generated in API(when calling to generate embedded token you need to pass Access Token like to all restricted API) for just be able to embedded single dashboard or report.

[Eric_Zhang · Accepted solution]

@mda

1. The registered Azure APP doesn't have anything to do with Power BI reports except to get the accesstoken. If you want to embed your reports in an external application you have to publish it to PowerBI service,

2.You could get the accesstoke and embedded token via two REST APIs as below.

--get the access token
POST /common/oauth2/token HTTP/1.1
Host: login.windows.net
Cache-Control: no-cache 
Content-Type: application/x-www-form-urlencoded

client_id=49dxxxxxxxthe register app client idxxxxx0-6d93f770d1a4&grant_type=password&resource=https%3A%2F%2Fanalysis.windows.net%2Fpowerbi%2Fapi&username=yourpowerbiaccount&password=yourpowerbipassword

--To get the embedded token for a report/dashboard/tile
--reference https://msdn.microsoft.com/en-us/library/mt784614.aspx

POST /v1.0/myorg/groups/dc5811-YOURGROUPID-f16b6c15/reports/16d21d5a-YOURreportID--46a2fd9/GenerateToken HTTP/1.1
Host: api.powerbi.com
Content-Type: application/json
Authorization: Bearer theTokenFromPriorAPI
Cache-Control: no-cache 

{
 "accessLevel": "View"
}

3. Yes, it needs a Premium licence if you want to use  Embedding with non-Power BI users (app owns data). For cost-saving, a more simpler approach would be using Publish to web, you don't have to apply option 1&2.

[sergio170]

The first api returns the AccessToken and the RefreshToken, everything works fine...

But, when i use the second API, to generate the Embed Token, i get this message:

{"error":{"code":"BadRequest","message":"Bad Request","details":[{"message":"'request' is a required parameter","target":"request"}]}}

My app is full permissions to the access token retrieved from the AzureAD, and the reportId/datasetId i got from:

https://api.powerbi.com/v1.0/myorg/reports

So, what could be the error? 

My request, with JQuery:

$.ajax({
type: 'POST',
url: `https://api.powerbi.com/v1.0/myorg/groups/${this.groupId}/reports/${this.reportId}/GenerateToken`,
headers: {
"Content-Type": "application/json",
"Authorization": `Bearer ${this.authToken}`
},
body: {
"accessLevel": "View",
"datasetId": this.datasetId
},
success: (data) => {
console.log('ss', data)
},
error: (data) => {
console.log('rr', data)
}
});

[nitinkhubani]

Try passing below instead of Body in AJAX call..

data: {
"accessLevel": "View"
},
dataType: 'application/json',

Nitin Khubani

[pzielinski]

I solved the problem. Sharing dashboard is not enough, the data which are provided to this dashboard, all need to share also. 

[mda]

Are you trying to call this API from a browser?

It was not working for me - I think it was not working because server doesn't send access-control-allow-origin header
I wrote a Java client to REST API and used it to obtain tokens.
You can also run it from JavaScript but on the server side, not from the browser.

[sergio170]

Yes!

i'm trying to call the api from a browser (and from Postman too)

Thanks for your answer! Now i'm getting another error:

{"error":{"code":"PowerBIEntityNotFound","pbi.error":{"code":"PowerBIEntityNotFound","parameters":{},"details":[]}}}

I've made everything step by step... and i have the PowerBI Pro account... My AzureAD, like i said, have all needed permissions and works as expected (giving me the access token).

Do you know what it can be?

[pzielinski]

Did you solve the problem? Because I am facing same issue

[mda]

Unfortunately, I have no idea.

[adjimenez]

This is not working for me, i get errors on the first api call

{
    "error": "invalid_grant",
    "error_description": "AADSTS65001: The user or administrator has not consented to use the application with ID '3ae04a38-c62e-459b-89ad-894c0df9120f'. Send an interactive authorization request for this user and resource.\r\nTrace ID: 1ca981c2-722f-44e8-a6de-ea68d22c1d00\r\nCorrelation ID: c57e252f-d4e3-4bd6-a958-f56b3ff4386b\r\nTimestamp: 2017-08-04 14:14:49Z",
    "error_codes": [
        65001
    ],
    "timestamp": "2017-08-04 14:14:49Z",
    "trace_id": "1ca981c2-722f-44e8-a6de-ea68d22c1d00",
    "correlation_id": "c57e252f-d4e3-4bd6-a958-f56b3ff4386b"
}

[mda]

Hi Eric.

Thanks for your answers.

1. The registered Azure APP doesn't have anything to do with Power BI reports except to get the accesstoken. If you want to embed your reports in an external application you have to publish it to PowerBI service,

Thanks for the info.

In the mean time, I also figured it out - the reason to register Azure AD app is to get Client ID.

I think that you should write about this in article Register an Azure AD app to embed Power BI content.

2.You could get the accesstoke and embedded token via two REST APIs as below.

--get the access token
POST /common/oauth2/token HTTP/1.1
Host: login.windows.net
Cache-Control: no-cache 
Content-Type: application/x-www-form-urlencoded

client_id=49dxxxxxxxthe register app client idxxxxx0-6d93f770d1a4&grant_type=password&resource=https%3A%2F%2Fanalysis.windows.net%2Fpowerbi%2Fapi&username=yourpowerbiaccount&password=yourpowerbipassword

--To get the embedded token for a report/dashboard/tile
--reference https://msdn.microsoft.com/en-us/library/mt784614.aspx

POST /v1.0/myorg/groups/dc5811-YOURGROUPID-f16b6c15/reports/16d21d5a-YOURreportID--46a2fd9/GenerateToken HTTP/1.1
Host: api.powerbi.com
Content-Type: application/json
Authorization: Bearer theTokenFromPriorAPI
Cache-Control: no-cache 

{
 "accessLevel": "View"
}

Thanks for informing that authorization code and access token are not the same. I read article Authenticate users and get an Azure AD access token for your Power BI app and I didn't notice the difference.

In the mean time, I found Microsoft Azure Active Directory Authentication Library (ADAL) for Java and it worked to get the authorization code. But I thought that this authorization code is an access token and tried to use it to embed my report using powerbi-client and it didn't work. Now I know that this wasn't an access code.

And with the API which you pointed it start to work.

Big thanks.

3. Yes, it needs a Premium licence if you want to use  Embedding with non-Power BI users (app owns data). For cost-saving, a more simpler approach would be using Publish to web, you don't have to apply option 1&2.

---

Publishing to web is not the option for us.