Tried a lot of options to get this issues:
1. creating embed token with effective identity is not supported for this datasource
2. creating embed token for accessing dataset <guid> requires effective identity to be provided.


public async Task<EmbeddedReport> GetReport(Guid reportId, Guid workspaceId, string username)
{
try
{
var pbiClient = await GetPowerBiClientAsync();
var report = await pbiClient.Reports.GetReportInGroupAsync(workspaceId, reportId);
var tokenRequest = new GenerateTokenRequestV2
{
Reports = new List<GenerateTokenRequestV2Report>
{
new() { Id = reportId },
},
TargetWorkspaces = new List<GenerateTokenRequestV2TargetWorkspace>
{
new() { Id = workspaceId },
},
Datasets = new List<GenerateTokenRequestV2Dataset>
{
new() { Id = report.DatasetId },
},
//Identities = new List<EffectiveIdentity>
//{
// new() {
// Username = username,
// Roles = new List<string>(),
// Datasets = new List<string> { report.DatasetId },
// },
//},
};
var tokenResponse = await pbiClient.EmbedToken.GenerateTokenAsync(tokenRequest);
var embedToken = tokenResponse.Token;
return new EmbeddedReport
{
Id = report.Id.ToString(),
EmbedUrl = report.EmbedUrl,
Name = report.Name,
Token = embedToken,
};
}
catch (Exception ex)
{
_logger.LogError(ex, "Failed to get report");
throw new InvalidOperationException($"Failed to get report: {ex.Message}");
}
}
private async Task<PowerBIClient> GetPowerBiClientAsync()
{
var token = await GetAccessTokenAsync();
var credentials = new TokenCredentials(token, "Bearer");
return new PowerBIClient(new Uri("https://api.powerbi.com/"), credentials);
}
private async Task<string> GetAccessTokenAsync()
{
try
{
var app = ConfidentialClientApplicationBuilder.Create("<guid-value>")
.WithClientSecret("<guid-value>")
.WithAuthority(new Uri($"https://login.microsoftonline.com/<guid-value>"))
.Build();
var result = await app.AcquireTokenForClient(_scopes).ExecuteAsync();
return result.AccessToken;
}
catch (Exception ex)
{
_logger.LogError(ex, "Failed to get token");
return "";
}
}
Did apply all the necessary permissions. Enable the Service Principal and add it to Manage Access as a Member to all needed reports, API permissions in azure.portal, Dataset.Read.All, Dataset.ReadWrite.All, Report.Read.All, Report.ReadWrite.All, Workspace.Read.All, Workspace.ReadWrite.All, etc.
Your help very much appreciated.