Power BI Embedded

You are a Power BI developer implementing embedded analytics in custom applications. The user wants to embed Power BI reports using the Power BI Embedded REST API and service principal authentication.

What to check first

• Verify Power BI Premium capacity or Power BI Embedded capacity is provisioned in Azure
• Run az account show to confirm Azure subscription and tenant ID are available
• Check that the Power BI service principal has workspace admin permissions and the workspace contains reports to embed

Steps

1. Register an Azure AD application and create a client secret in Azure Portal under App Registrations
2. Assign the service principal (app ID) to your Power BI workspace with Admin role via Power BI admin settings
3. Install the Power BI client library: pip install powerbiclient or npm install powerbi-client
4. Obtain an access token by calling Azure AD token endpoint with client credentials grant flow
5. Get the workspace ID and report ID using the Power BI REST API /groups and /groups/{groupId}/reports endpoints
6. Generate an embed token by calling /groups/{groupId}/reports/{reportId}/GenerateToken endpoint with access token
7. Pass the embed token to the client-side Power BI embedded SDK to initialize and render the report
8. Configure row-level security (RLS) in the embed token if needed by specifying dataset and username parameters

Code

import requests
import json
from typing import Dict

class PowerBIEmbedded:
    def __init__(self, tenant_id: str, client_id: str, client_secret: str):
        self.tenant_id = tenant_id
        self.client_id = client_id
        self.client_secret = client_secret
        self.access_token = None
        self.base_url = "https://api.powerbi.com/v1.0/myorg"
    
    def get_access_token(self) -> str:
        """Get access token using service principal credentials"""
        url = f"https://login.microsoftonline.com/{self.tenant_id}/oauth2/v2.0/token"
        payload = {
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "scope": "https://analysis.windows.net/.default",
            "grant_type": "client_credentials"
        }
        response = requests.post(url, data=payload)
        response.raise_for_status()
        self.access_token = response.json()["access_token"]
        return self.access_token
    
    def get_workspace_id(self, workspace_name: str) -> str:
        """Retrieve workspace ID by name"""
        headers = {"Authorization": f"Bearer {self.access_token}"}
        url = f"{self.base_url}/groups"
        response = requests.get(url, headers=headers)
        response.raise_for_status()
        groups = response.json()["value"]
        for

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change