'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Access Power BI Embedded APIs from an External B2C Tenant App
Question details
The user needs to know how an application registered in an external Microsoft Entra B2C tenant can authenticate and access Power BI Embedded APIs hosted in a separate corporate B2B tenant.
- Product
- Power BI Embedded
- Device & OS
- not provided
- Scenario
- Setting up cross-tenant authentication for a custom application to embed Power BI reports via API.
- Observed behavior
- The user is evaluating the feasibility and required architecture for cross-tenant API access, app permissions, and authentication flows.
Ensure you have global administrator or privileged role administrator permissions in both the Microsoft Entra B2C tenant and the target corporate B2B tenant where Power BI is hosted.
Review Cross-Tenant Configuration and App Registration
Verify the app registration, tenant consent, and service principal configurations across both Azure tenants to allow secure API access.
Implementing cross-tenant authentication requires careful configuration of service principals and API permissions to ensure the external application can communicate with Power BI.
In the Microsoft Entra B2C tenant, register your application and configure the authentication flow to support the necessary user identities.
In the corporate B2B tenant, set up a service principal (App-only authentication) or grant admin consent for the cross-tenant application to access the Power BI Service APIs.
Navigate to the Power BI Admin portal and ensure that the service principal or registered app is added as an Admin or Member to the workspace containing the reports to be embedded.
Ensure that the Power BI workspace is assigned to a dedicated Premium or Embedded capacity to properly support embedding for external users.
Consult the Microsoft Fabric Community for Specialized Architecture
Since cross-tenant B2C to B2B authentication flows can be highly complex, engaging with Microsoft Developer experts is recommended to validate your architecture.
Try WPS Office for Your Documentation and Data Analysis Needs
While configuring complex Azure architectures like Power BI cross-tenant authentication requires Microsoft services, you can rely on WPS Office for planning, documenting, and presenting your architecture designs. WPS Office is a lightweight, fully-featured suite that is highly compatible with Microsoft Word, Excel, and PowerPoint.
- 1. Download WPS Office: Visit the official WPS Office website and download the installer for your operating system.
- 2. Install and Launch: Follow the on-screen instructions to install the suite and open WPS Writer, Spreadsheet, or Presentation.
- 3. Start Documenting: Create or open your existing Microsoft Office files to start planning your app registrations and API integration processes.
Frequently Asked Questions
Can I use the 'User-owns-data' embedding approach across different tenants?
Cross-tenant 'User-owns-data' scenarios are generally not natively supported without complex Azure AD B2B collaboration setups. The 'App-owns-data' (Service Principal) approach is strongly recommended for embedding Power BI content in an external app.
Does the service principal need a Power BI Pro license?
No, a service principal does not require a Power BI Pro license. However, the workspace where the content resides must be backed by a Power BI Premium or Embedded capacity.
Why am I getting an unauthorized error when calling the Power BI Embedded API?
Unauthorized errors typically occur if the service principal has not been granted explicit access to the Power BI workspace, or if the 'Allow service principals to use Power BI APIs' tenant setting is disabled in the Power BI Admin portal.
How do I enable Service Principals in Power BI?
Go to the Power BI Admin portal, navigate to Tenant settings, scroll down to Developer settings, and enable 'Allow service principals to use Power BI APIs'. It is recommended to restrict this permission to specific security groups for safety.
