Register an Azure AD application to use with Power BI

These steps describe how to register an Azure AD application for the Power BI embed for your customers solution.

1. Open the Power BI App Registration Tool.

2. In the Choose an embedding solution section, select Embed for your customers.

3. In Step 1 - sign in to Power BI, sign in with a user that belongs to your Power BI tenant. The Azure AD app will be registered under this user.

   If you're already signed in, verify that you're signed in with the user you want to use for creating the Azure AD app. To change a user, select the sign out link and once the tool restarts, sign in again.

4. In Step 2 - Register your application, fill in the following fields:

   • Application Name - Give your application a name.

   • API access - Select the Power BI APIs (also known as scopes) that your application needs. You can use Select all to select all the APIs. For more information about Power BI access permissions, see Permissions and consent in the Microsoft identity platform endpoint.

5. Select Register.

   Your Azure AD app Application ID is displayed in the Summary box. Copy this value for later use.

6. (Optional) In Step 3 - Create a workspace, you can create a workspace in Power BI service.

   • If you already have a Power BI workspace, select Skip.

   • To create a workspace, enter a name for your workspace and select Create workspace. Your Workspace name and ID appear in the Summary box. Copy these values for later use.

   Note

   For the embedded analytics sample app to work as expected, you have to create a workspace using the tool.

7. (Optional) In Step 4 - Import content, select one of following options:

   • If you have your own Power BI app, you can select Skip.

   • If you want to create a sample Power BI app using a sample report, select Sample Power BI report and then select Import.

   • If you want to create a sample Power BI app using your own report, select Upload a .pbix file, browse for your file and then select Import.

8. In Step 5 - Grant permissions, select Grant permissions and in the pop-up window select accept. This allows your Azure AD app to access the APIs you selected (also known as scopes) with your signed in user. This user is also known as the master user.

9. (Optional) If you created a Power BI workspace and uploaded content to it using the tool, you can now select Download sample application. Make sure you copy all the information in the Summary Box.

These steps describe how to register an Azure AD application for the Power BI embed for your organization solution.

1. Open the Power BI App Registration Tool.

2. In the Choose an embedding solution section, select Embed for your organization.

3. In Step 1 - sign in to Power BI, sign in with a user that belongs to your Power BI tenant. The Azure AD app will be registered under this user.

   If you're already signed in, verify that you're signed in with the user you want to use for creating the Azure AD app. To change a user, select the sign out link and once the tool restarts, sign in again.

4. In Step 2 - Register your application, fill in the following fields:

   • Application Name - Give your application a name.

   • Home Page URL - Enter a URL for your home page.

   • Redirect URL - Upon singing in, your application users will be redirected to this address while your application receives an authentication code from Azure. Select one of these options:

     • Use a default URL - This option will automatically create and download a sample embedded analytics application. The default URL is http://localhost:13526/.

     • Use a custom URL - Select this option if you already have an embedded analytics application, and know what you want to use as a redirect URL.

   • API access - Select the Power BI APIs (also known as scopes) that your application needs. You can use Select all to select all the APIs. For more information about Power BI access permissions, see Permissions and consent in the Microsoft identity platform endpoint.

5. Select Register.

   Your Azure AD app Application ID and Application secret values are displayed in the Summary box. Copy these values for later use.

6. (Optional) In Step 3 - Create a workspace, you can create a workspace in Power BI service.

   • If you already have a Power BI workspace, select Skip.

   • To create a workspace, enter a name for your workspace and select Create workspace. Your Workspace name and ID appear in the Summary box. Copy these values for later use.

   Note

   For the embedded analytics sample app to work as expected, you have to create a workspace using the tool.

7. (Optional) In Step 4 - Import content, select one of following options:

   • If you have your own Power BI app, you can select Skip.

   • If you want to create a sample Power BI app using a sample report, select Sample Power BI report and then select Import.

   • If you want to create a sample Power BI app using your own report, select Upload a .pbix file, browse for your file and then select Import.

8. (Optional) If you created a Power BI workspace and uploaded content to it using the tool, you can now select Download sample application. Make sure you copy all the information in the Summary Box.

Use the Azure AD manual app registration only if you're creating one of the following solutions:

• An embed for your organization application.

• An embed for your customers application with a service principal.

  Note

  If you choose this option, after you register your Azure AD app you'll have to add Power BI permissions to it.

For more information about how to register applications in Azure Active Directory, see Register an app with the Azure Active Directory.

1. Sign into the Azure portal.

2. Select your Azure AD tenant by selecting your account in the upper right corner of the page.

3. Select App registrations. If you can't see this option, search for it.

4. In App registrations, select New registration.

5. Fill in the following fields:

   • Name - Give your application a name.

   • Supported account type - Select who can use the application.

6. (Optional) In the Redirect URI, add a redirect URL.

7. Select Register. After your app is registered you're directed to your app's overview page, where you can obtain the Application ID.

In the Azure portal, you can view your app and make changes to its permissions.

1. Sign into the Azure portal.

2. Select your Azure AD tenant by selecting your account in the upper right corner of the page.

3. Select App registrations. If you can't see this option, search for it.

4. From the Owned applications tab, select your app. The application opens in the Overview tab, where you can review the Application ID.

5. Select the API permissions tab.

6. To add permissions, follow these steps:

   1. Select Add a permission and then select Power BI service.

   2. Select Delegated Permissions and add or remove the specific permissions you need.

   3. When you're done, select Add permissions to save your changes.

7. To remove a permission, follow these steps:

   1. Select the ellipsis (...) to the right of the permission.

   2. Select Remove permission.

   3. In the Remove permission pop-up window, select Yes, remove.

To change your Azure AD app permissions programmatically, you'll need to get the existing service principals (users) within your tenant. For information on how to do that, see servicePrincipal.

1. To get all the service principals within your tenant, call the Get servicePrincipal API without {ID}.

2. Check for a service principal with your app's application ID as the appId property.

   Post https://graph.microsoft.com/v1.0/servicePrincipals HTTP/1.1
   Authorization: Bearer ey..qw
   Content-Type: application/json
   {
   "accountEnabled" : true,
   "appId" : "{App_Client_ID}",
   "displayName" : "{App_DisplayName}"
   }
   

   Note

   displayName is optional.

3. Grant Power BI permissions to your app, by assigning one of these values to consentType:

   • AllPrincipals - Can only be used by a Power BI admin to grant permissions on behalf of all the users in the tenant.

   • Principal - Use to grant permissions on behalf of a specific user. If you're using this option, add the principalId={User_ObjectId} property to the request body.

   Post https://graph.microsoft.com/v1.0/OAuth2PermissionGrants HTTP/1.1
   Authorization: Bearer ey..qw
   Content-Type: application/json
   {
   "clientId":"{Service_Plan_ID}",
   "consentType":"AllPrincipals",
   "resourceId":"c78a3685-1ce7-52cd-95f7-dc5aea8ec98e",
   "scope":"Dataset.ReadWrite.All Dashboard.Read.All Report.Read.All Group.Read Group.Read.All Content.Create Metadata.View_Any Dataset.Read.All Data.Alter_Any",
   "expiryTime":"2018-03-29T14:35:32.4943409+03:00",
   "startTime":"2017-03-29T14:35:32.4933413+03:00"
   }
   

   Note

   • If you're using a master user, to avoid being prompted for consent by Azure AD, you need to grant permissions to the master account.
   • The resourceId c78a3685-1ce7-52cd-95f7-dc5aea8ec98e is tenant dependent and not universal. This value is the objectId of the Power BI Service application in Azure AD. To get this value from the Azure portal, navigate to Enterprise applications > All applications, and search for Power BI Service.

4. Grant app permissions to Azure AD, by assigning a value to consentType.

   Post https://graph.microsoft.com/v1.0/OAuth2PermissionGrants HTTP/1.1
   Authorization: Bearer ey..qw
   Content-Type: application/json
   {
   "clientId":"{Service_Plan_ID}",
   "consentType":"AllPrincipals",
   "resourceId":"61e57743-d5cf-41ba-bd1a-2b381390a3f1",
   "scope":"User.Read Directory.AccessAsUser.All",
   "expiryTime":"2018-03-29T14:35:32.4943409+03:00",
   "startTime":"2017-03-29T14:35:32.4933413+03:00"
   }
   

You can also change your Azure AD app permissions using C#. For more information see the oAuth2PermissionGrant API. This method can be useful if you're considering to automate some of your processes.

For more information regarding the HTTP requests, refer to the HTTP tab.

var graphClient = GetGraphClient();

currentState.createdApp = await graphClient.Applications
    .Request()
    .AddAsync(application);

System.Threading.Thread.Sleep(2000);

var passwordCredential = new PasswordCredential
{
    DisplayName = "Client Secret Created in C#"
};

currentState.createdSecret = await graphClient.Applications[currentState.createdApp.Id]
    .AddPassword(passwordCredential)
    .Request()
    .PostAsync();

var servicePrincipal = new ServicePrincipal
{
    AppId = currentState.createdApp.AppId
};

currentState.createdServicePrincipal = await graphClient.ServicePrincipals
    .Request()
    .AddAsync(servicePrincipal);

GraphServiceClient graphClient = new GraphServiceClient(authProvider);

// Use oAuth2PermissionGrant to change permissions
var oAuth2PermissionGrant = await graphClient.Oauth2PermissionGrants["{id}"]
               .Request()
               .GetAsync();