Why this setup is needed
To embed Power BI reports and dashboards into your app, you register an application in Azure Active Directory (Azure AD). This lets embedportal authenticate with Power BI on your behalf using a service principal, so reports embed securely while your data stays in your own Power BI workspace.
Connect Power BI to embedportal: Azure Portal setup
Register an app in Azure AD and configure API permissions for the Power BI Service. Six steps:
1. Register a new application
- Go to Azure AD App Registrations.
- Click New registration.
- Name:
embedportal Power BI Integration. - Supported account types: Accounts in this organizational directory only.
- Click Register.
2. Copy the application identifiers
From the app’s Overview page, copy:
- Application (client) ID → your Client ID.
- Directory (tenant) ID → your Tenant ID.
3. Create a client secret
- Go to Certificates & secrets → Client secrets → New client secret.
- Description:
embedportal Integration. - Expires: 24 months (recommended).
- Copy the Value (not the Secret ID) → your Client Secret.
Important: the secret value is shown only once — copy it immediately.
4. Configure API permissions
- Go to API permissions → Add a permission → select Power BI Service.
- Select Delegated permissions.
- Add:
Report.Read.All,Dashboard.Read.All,Dataset.Read.All. - Click Add permissions.
- Click Grant admin consent for [Your Organization] → Yes.
5. Enable service principals in the Power BI Admin portal
- Go to Power BI Admin Portal → Tenant settings.
- Under Developer settings, confirm Service principals can call Fabric public APIs is Enabled (this replaced the older “Allow service principals to use Power BI APIs” setting and is on by default for new tenants).
- Leave it applied to the entire organization, or restrict it to a security group that contains your app.
- Also confirm Embed content in apps is Enabled — required to generate embed tokens.
- Click Apply, then allow ~15 minutes for the change to take effect.
Note: you must be a Power BI admin to access tenant settings.
6. Add the service principal to your workspace
- Open the Power BI workspace containing the reports you want to embed.
- Click Access → Add people.
- Search for your app name (
embedportal Power BI Integration). - Grant Member access (Viewer is not sufficient to generate embed tokens).
Finish in embedportal
Paste the Client ID, Tenant ID, and Client Secret into embedportal. From there, embedportal handles the secure embedding, per-tenant row-level security, and white-labeling — your data never leaves your Power BI workspace, and each customer sees only their own reports.
Security best practices
- Rotate client secrets every 24 months.
- Grant the service principal at least Member workspace access — Viewer can’t generate embed tokens.
- Monitor service principal usage in Azure AD audit logs and Power BI activity logs.
