To generate access tokens for Power BI Embedded, do the following, as prescribed by Microsoft, on how to ensure secure authentication with Azure AD and token management for your application:
1. Authenticate Azure AD
It includes registering your Azure AD application within the Azure portal and configuring appropriate API permissions for Azure Power BI Service. Secure your application with a proper authentication method, such as OAuth 2.0, where the client application requests a token through either client credentials or delegated flow, depending on the specific need.
2. Generate Embed Token
Use the acquired Azure AD access token to invoke the Power BI REST API right after authentication. Use the GenerateToken API to generate the embed token for reports, dashboards, or datasets. The request should indicate the level of access required and any user-specific permissions that your application would need to implement to enforce any row-level security (RLS) if required.
3. Secure Storage and Transmission
It should be noted that sensitive parameters, such as the client secret, should never be directly coded into the application; instead, they should be secured using Azure Key Vault. Ensure that all transmissions between your application and the Power BI service are HTTPS encrypted to enable end-to-end encryption while in transit.
Manage Token Expiration
Azure AD-generated access tokens are usually short-lived (1 hour, for example). Implemented the logic of token refreshing to request new access before the expiry of the current access.
The same applies to embed tokens. It has an expiration duration. Monitor the token for its validity, and when invoking the GenerateToken API, it regenerates when the monitored condition calls for it.
5. Follow the Principle of Least Privilege
Make sure to configure the Azure AD app to utilize the minimal permissions necessary to perform the operations. Avoid using permissions beyond what is required, such as Tenant.Read.All.
Restrict embed token scopes to just the Power BI objects (either reports or datasets) that the user or application needs access to.
6. Audit and Monitor Usage
Enable logging for token generation and API calls. Research access token use, anomaly detection, and compliance enforcement using Azure Monitor or similar resources.
Such practices help secure the generation and management of access tokens in Power BI Embedded while minimizing possible risks.
