Azure Web App AAD Authentication with PBI API

Question

Hi,

I have created an App Registration, where the API Permissions for PBI (Delegated) are granted.
The App Registration also has a client secret.

Next I have created an App Service where one of the slots is used for a Web App (React + .NET Core).
For the App Service (Deployment Slot) I have enabled Authentication with AAD, and added the client secret of the App Service.

This all works fine. When a user goes to the Web App, they get a login screen. After logging in they have to accept the API Permissions for the App.
When a user is on a certain page, I make a GET request to ".auth/me" which gives back some information about the user and an access_token and id_token.

What I now want to do is use that access token to make a call to the PBI API, however, I keep getting a forbidden / unauthorized error.
However, when I use Powershell to generate a PBI Access Token and hardcode it into my web app, it does work. So it seems the token I get back from ".auth/me" doesn't have access to PBI, even though users have to accept the API Permissions dialog.
I'm using this React package: https://github.com/microsoft/powerbi-client-react.

Is what I'm trying to do possible?

Answer 1

By default the audience of the access token is the app itself. Follow the steps detailed in Refresh identity provider tokens to include https://analysis.windows.net/powerbi/api as a resource/audience. Basically using Azure Resource Explorer you have to add this under subscriptions > <subscription_name > resourceGroups > <resource_group_name> > providers > Microsoft.Web > sites > <app_name> > config > authsettings:

   "additionalLoginParams": [  
       "response_type=code id_token",  
       "resource=https://analysis.windows.net/powerbi/api"  
   ],  

--
Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.

Answer 2

Do you have a github link for your code pls