Power BI Consent Issue AADSTS65001 and AADSTS500119

[Mbalcarek]

Hello,

I am using code to display a Power BI embedded report (using app master credentials). This code works for our older tenant, using our existing app registration, but I get the following error (AADSTS65001 displayed below) with a different tenant and using a new app registration. I followed the instructions here to register the new app: per https://docs.microsoft.com/en-us/power-bi/developer/register-app

but something has changed.

I have tried to overcome the AADSTS65001 error by using:

1. the azure portal; active directory; app registrations – this appears to succeed, but the error persists.
2. the azure portal; active directory; enterprise applications; permissions; grant admin consent – this fails with the AADSTS500119 error: I have turned on ‘advanced diagnostics’ for you. (I used our global admin)
3. Granting admin consent using url: https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/authorize?client_id=xxx93e21-fbde-... this also gets the AADSTS500119 error.  (I used our global admin)

Finally another reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent

Original error:

{"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID 'eb790bb4-66d8-447b-aae6-4253dc46b1f1' named 'Epilogue Power BI Integration'. Send an interactive authorization request for this user and resource.\r\nTrace ID: 3c3194ce-9da9-4770-ab0e-026dbabb6a00\r\nCorrelation ID: 00b0e49c-0ed7-4222-a949-2a3e9b7524da\r\nTimestamp: 2019-03-22 17:21:14Z","error_codes":[65001],"timestamp":"2019-03-22 17:21:14Z","trace_id":"3c3194ce-9da9-4770-ab0e-026dbabb6a00","correlation_id":"00b0e49c-0ed7-4222-a949-2a3e9b7524da","suberror":"consent_required"}: Unknown error

And when trying to give admin consent (via UI or via URL):

AADSTS500119: Redirect URIs with urn: schemes are prohibited. Use a different scheme, or https://login.microsoftonline.com/common/oauth2/nativeclient

Do I need to set up a service principal (I tried it and it did not appear to work)? I never had to do that in the past.

Thank you for any advice.

[Mbalcarek · Accepted solution]

It looks like there was a related issue at Microsoft. The issue resolved itself over the weekend, without changes on my end.