Power BI Embedded for Gov clouds

Most of the articles/posts/questions published on community or websites would be on Power BI “Commercial” product. The URL you have seen would be https://app.powerbi.com

This blog post is about “https://app.powerbigov.us” – Power BI URL for US Gov customers. More specifically this blog post is about embedding Power BI assets (Reports, Dashboards, QnA) for US Gov customers.

I would like to highlight certain differences in app registration URL and config URLs when embedding Power BI assets for US Gov clouds.

-> App Registration URL

The app registration URL for commercial cloud and US Gov cloud for Power BI Embedded are different. For:

  1. Commercial Product -> https://dev.powerbi.com/apps
  2. US Gov Product -> https://dev.powerbigov.us/apps

-> When you register your app, the Power BI API name in Azure Portal would look like this:

Commercial Product

commercialproduct

US Gov Product

govproduct

TIP: Based on our experience, when troubleshooting please look out for the API name that you see in Azure Portal. If you are embedding for Gov clouds, the API name should be “Microsoft Power BI Government Community Cloud”. If that is not the name, you would need to register the app on https://dev.powerbigov.us/apps

-> Embedding Config URLs

Commercial Product

commercialproductconfig

US Gov Product

govproductconfig

You would see “resourceUrl”, “apiUrl” and “embedUrlBase” is different in case of US Gov clouds.

That’s it. These are the only changes in configuration and setup required for embedding in Power BI US Gov clouds. Everything else remain the same.

If you are looking for details on embedding with a sample .NET code, please head to our  blog post on baby steps to embed your Power BI report.

Apply the configuration changes as mentioned in this blog post and you would be set to see the Power of embedded analytics for your US Gov clouds.

Questions? Please contact us through our website.

Thank you

Baby steps to embed your Power BI reports

There are three major steps in setting up Power BI Embedded for your Power BI Reports. These steps apply to embed your dashboards or Q&A as well (except for permission settings).

In this blog post we will be setting up Power BI Embedded for ISV or “App owns data” scenarios. The scenario where your users need not have Power BI License to view reports. You embed Power BI Reports in your custom application say, e-commerce site, or health app etc. for your end users.

Here are those three major steps to embed your reports.

Note: Some of the settings differ when you embed for US Gov clouds. Read our brand new post on settings when embedding for US Gov clouds here

1. Register application

2. Set up permissions in Azure Portal

3. Set up sample code to embed Power BI Reports

Step 1: Register application

Step by Step guide.

a. Go to https://dev.powerbi.com/apps and register your application. This step is required since Power BI Rest APIs or .NET SDK requires an “application” to connect to Power BI to get token for embedding.

This application is not your custom application (or portal) where the reports will be embedded.

b. Login with your Power BI Account. This is the account where you have Pro or Premium license assigned. This could be yours or a master account (non-human).

c. Add the following setup. You can put any App Name, but App Type should be “Native” and Redirect URL should be “http://localhost:13526” as shown below.

pbiappname

d. Select APIs to access. If you want to embed Power BI Report you may select only “Read All Reports” settings for now. We will change these in Azure Portal later.

pbiapistoaccess

e. Click on “Register App” button. You will receive your client id (or application id as it is called in Azure Portal). Keep it handy

pbiregisterapp

Step 2: Set up permissions in Azure Portal

Let’s log in to Azure Portal using our Power BI account (the account used to register application above).

a. Login to portal.azure.com

b. Navigate to the Azure Active Directory in the left panel and click on App Registrations. If you do not see your app you just created, select “All Apps” instead of “My Apps”

pbiazureappreg.PNG

c. Click on “PBIEmbedApp” and then on Settings and Required permissions

pbiazureclickpermissions.png

d. On the Required permissions, select Power BI Service and enable two more settings “View all Datasets” and “Create content”. Yes, you need these two settings for embedding your Power BI Reports else you would get 403 error when fetching embed token.

Click on “Save”.

pbiazurepbiservice.PNG

e. After saving you would see “3” delegated permissions for Power BI Service. While Power BI Service is selected, click on “Grant permissions”.

pbiazure3grant.PNG

This would grant permissions to your app.

pbiazuregrant.PNG

You are set to embed your reports now! You would need 3 things to embed your report in your application.

a. Your app’s client id (Remember I had asked you to keep that handy above). If you miss it no worries, go to Azure Portal and grab the “application Id” for your app under Azure Active Directory. This is nothing but your client id.

b. Power BI Report Group ID and Report ID. How do you find out your report’s group id and report id? Navigate to your Power BI report in Power BI portal. Copy the URL

pbiurl.png

Anything after “groups/” but before “/reports” shown above in red box is group_id, and anything after “reports/” but before the last “/” shown above in blue box is report_id. Copy them.

c. Your Power BI username and password. Usually in ISV or App owns data scenarios this is a master account. This means it can be a person’s account like you or me, or any other account which nobody (or I must say “no human”) will use.

Step 3: Set up sample code to embed Power BI Reports

Download sample code from Microsoft’s GitHub repo. You will need to use “PowerBIEmbedded_AppOwnsData” project.

Github URL: https://github.com/Microsoft/PowerBI-Developer-Samples/tree/master/App%20Owns%20Data

Under: PowerBI-Developer-Samples-master\App Owns Data\PowerBIEmbedded_AppOwnsData

Go to web.config and update the following settings – applicationId, workspaceId, reportId, pbiUsername, pbiPassword.

pbicodesettings.PNG

Your client id is application id and group id is workspaceid.

Run the application in Visual Studio, and you will see your report embedded!

pbiembed.PNG

If you have any questions, feel free to comment on the blog post, or contact us.

Note: Some of the settings differ when you embed for US Gov clouds. Read our brand new post on settings when embedding for US Gov clouds here

Resolved – Request is not a valid SAML 2.0 protocol message – when embedding Power BI Reports with federated authentication

Phew! Finally, we were able to resolve the error “Request is not a valid SAML 2.0” when embedding Power BI Reports with federated authentication. It took us some time but thanks to the wonderful Microsoft support team who worked with us in debugging and isolating the issues.

Our scenario: Enterprise customer with Power BI Premium capacity planning to embed Power BI reports in an internal application using “App Owns Data” approach. There are scenarios why would you embed for enterprises (also called as organizational embedding), and scenarios why would you use “App Owns Data” approach over “User owns Data” approach. More about this in another blog post.

Ok, then why this error? How to solve it?

Why this error:

When you authenticate using master account the request goes to a federated server (in this case customer’s Identity Provider (IdP)), the IdP validates the credentials, sends back SAML assertion and TokenType, the Azure AD .NET libraries check the TokenType and assigns granttype. This granttype and SAML assertion is sent to Azure AD for confirmation.

In our particular case, the PingFederate Identity server was using a TokenType which Azure AD .NET SDK assumed to be of 2.0 and hence tagged granttype as “2.0” (urn:ietf:params:oauth:grant-type:saml2-bearer). But the assertion was not 2.0, it was actually 1.1.

Hence the error – Request is not a valid SAML 2.0 protocol message.

How to solve this error?

There are two ways to solve this error:

  1. Create a cloud account on customer’s tenant which would not be federated (simple solution), example: abc@tenantname.onmicrosoft.com
  2. Create SAML requests manually, fire to your IdP, modify the TokenType in the code and send this request to Azure AD. You will have to bypass using Azure AD libraries and construct your own requests. (complex solution)

We went ahead with solution 1, used this cloud account as our master account and were able to successfully embed the reports in enterprise internal applications.

You will not face this issue if your IdP is ADFS.

Hope this helps,

Until then,

Ranbeer Makin

Let me show you the secrets of setting up Power BI Premium for embedding scenarios

Hola!

One of our enterprise customers approached us for embedding their Power BI reports, dashboards and Q&A in their application. They had purchased Power BI Premium SKU and want to use Power BI embedded capabilities. In this blog post, we will explain how we helped our customer setup workspace with premium capacity and use it for embedding reports.

A quick recap of embedding your reports in Power BI:

  1. A master account (a user basically) with Power BI pro license in Azure AD tenant
  2. An application in Azure AD and with permissions setup (more on this in next blog)
  3. A workspace (or groups) to publish reports to be used in embedding
  4. User created in #1 to be admin of this newly created workspace

How do we assign premium capacity to this newly created workspace?

1. Go to “Settings icon” in PowerBI.com, and select “Admin portal”

AdminPortal

 

 

 

 

 

 

2. Inside of the Admin portal, select premium settings

PremiumSettings

3. On premium settings screen, select the capacity that you want to use

4. Click on “Assign Workspaces” in the capacity you have selected

AssignWorkspaces

5. You will be presented with a screen, add the user that you created initially (a master user, remember?)

AssignWorkspaces2

6. After this, go to this new workspace, edit it, and ensure in advanced settings “Premium” is ON. You need to have workspace assignment permissions in order to enable it.

PremiumOff

7. When selecting “ON”, select the appropriate Premium capacity that you want to assign to this new workspace

PremiumOn

Hit Save, you are done!

Now this workspace has Premium capacity turned ON. How do you verify it?

Go to this capacity in premium settings and check if this workspace is assigned.

workspacelisted

You are ready to embed your reports. You need to get a token, write some JavaScript and backend code and you are done!

Do you have questions? Let us know.

Contact us if you want to embed Power BI Reports, Dashboards or Q&A. We have helped enterprises, medium to small sized businesses develop and embed Power BI reports using varied sources of data with data sourcing, modeling, and compelling visualizations and analytics.

Or, head to our premium showcase section to see some of our work live in action.

 

Reference: https://www.youtube.com/watch?v=0Cy1V6LYjng