ConfidentialClientApplicationBuilder bearer token unauthorized

Question

I am trying to access Power BI web api from my web application. For msal, I can get the correct access token when I use PublicClientApplicationBuilder with my organizational email and password.

but I dont want that. It exposes my email and password. plus I belive, this method is only suitable for desktop based application. And I need to use an app only access token.It should not be tied to any specific user.

But when using ConfidentialClientApplicationBuilder with client secret added in Azure app registry, It gives me a different access token which is unauthorized while access anything.

Am I missing anything?

score 0 · Answer 1 · answered Aug 17 '23 at 05:20

Note that: Client Credential flow works only for Application API permissions.

The "401 unauthorized" error usually occurs if the access token does not contain required roles/scopes to perform the action.

To resolve the error, make sure to grant application type API permission to the Azure AD Application:

enter image description here

I generated the access token using the below code:

var scopesDefault = new string[] { "https://analysis.windows.net/powerbi/api/.default" };
var app = ConfidentialClientApplicationBuilder
.Create("ClientID")
.WithAuthority("https://login.microsoftonline.com/TenantID")
.WithClientSecret("ClientSecret")
.Build();
Microsoft.Identity.Client.AuthenticationResult result = await app
.AcquireTokenForClient(scopesDefault)
.ExecuteAsync();
var text = result.AccessToken;
Console.WriteLine(text);

enter image description here

When I decoded access token, roles are displayed:

enter image description here

If still the issue persists, check the below:

Few Power BI operations or accessing Power BI requires only delegated admin access token.
Based on your requirement you can assign delegated Api permissions and make use of Authorization Code Flow to generate access token.
Create an Azure Security Group and add the Service Principal as a Member:

enter image description here