Register an Entra App

Tldr

1. API Permissions: user_impersonation, Report.Read.All, and many more
2. scope: https://analysis.windows.net/powerbi/api/.default offline_access
3. Redirect URL: https://localhost:5000/signin-oidc

References

See also oauth-create-app.

The Entra app allows accessing the reports with a service principal (the Power BI user set up in the previous section).

Tip

If you have the Power BI Automation Server in use for the client, you may re-use that App. Then you just need to add the Redirect URL.

1. Create an Entra App registration

   1. call it Power BI Proxy
   2. write down the Application (client) ID

2. Set the Authentication

   3. set the Redirect URI to https://localhost:44300/
   4. allow ID tokens and

3. Give it the following API permissions

   1. Azure Service Management
      1. user_impersonation
   2. Power BI Service, delegated Permissions
      1. Report.Read.All
      2. Capacity.Read.All
      3. Dashboard.Read.All
      4. Dataflow.Read.All
      5. Dataset.Read.All
      6. App.Read.All"

4. Grant admin consent if necessary. If you don't have the rights, you can

   1. try to use our Microsoft Partner Access (ask Christoph)
   2. ask a local Admin from the client

5. Create a Client Secret and write down the Value and the Secret ID

Checklist

• you have an app registered
• you are the owner
• the app has a secret
• you have the value of the secret noted down
• the app has the right API Permissions
• the Permissions have been Granted by an admin