Skip to main content

MS Entra authentication for PowerBI (on-premise)

Prerequisites​

Setting up IIS​

First, we need to create and set dedicated copy of AlvaoRestApi application to serve reporting data.

  1. In Application Pools - Add Application Pool:

    • Name: AlvaoRestApiReports AppPool
    • All other settings (eg. AppPool identity) set the same as for the AlvaoRestApi AppPool

  2. In Sites – Default Web Site – Add Application:

    • Alias: AlvaoRestApiReports
    • Application pool: AlvaoRestApiReports App Pool
    • Physical path: same as for the AlvaoRestApi app (eg. C:\inetpub\wwwroot\AlvaoRestApi)
    • Click OK

  3. Go to <your server>/AlvaoRestApiReports and ensure that application is running OK. It should return same information as a standard AlvaoRestApi.

  4. Make AlvaoRestApiReports accessible from your public domain, eg. https://contoso.com/AlvaoRestApiReports

  5. In the installation path of the AlvaoRestApi (eg. C:\inetpub\wwwroot\AlvaoRestApi) open web.config and remove line: <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Production" />

  6. Open Command prompt as an administrator and run following commands:

cd C:\Windows\system32\inetsrv 

.\appcmd.exe set config -section:system.applicationHost/applicationPools /+"[name='AlvaoRestApiReports AppPool'].environmentVariables.[name='ASPNETCORE_ENVIRONMENT',value='Reports']" 

.\appcmd.exe set config -section:system.applicationHost/applicationPools /+"[name='AlvaoRestApi AppPool'].environmentVariables.[name='ASPNETCORE_ENVIRONMENT',value='Production']"

You can check the ASPNETCORE_ENVIRONMENT variables for the app pools using following command:

.\appcmd.exe list apppool "AlvaoRestApi AppPool" /config 

.\appcmd.exe list apppool "AlvaoRestApiReports AppPool" /config

Setting up MS Entra​

We need to create a new app registration in MS Entra that will be used just for authentication in Power BI.

  1. In App Registrations – Register an application

    • Name: AlvaoRestApi Reports

  2. In AlvaoRestApiReports – Expose an API

    note

    You need to verify your domain ownership in Domain Names service first

    • Add a scope

      • Name: Reports
      • Who can consent?: Admins and users
      • Admin consent display name: Alvao Reports
      • Admin consent description: Allows users to connect to Alvao Reports
      • State: Enabled

    • **Add a client application: **

      • ClientID: b52893c8-bc2e-47fc-918b-77022b299bbc
      • Authorized scopes: select previously added scope
      • Note: This is confidential client, used in Power BI service

    • Add a client application:

      • ClientID: a672d62c-fc7b-4e81-a576-e60dc46e951d
      • Authorized scopes: select previously added scope
      • Note: This is public client, used in Power BI Desktop and the gateway.

Finish the configuration​

  1. In the installation path of the AlvaoRestApi create a new file appsettings.Reports.json with:
    • attribute AAD_ApplicationId set to Application (client) ID of AlvaoRestApi Reports app registration created in the previous steps
    • attribute AAD_AdditionalAudience set to Set Application ID URL from your app registration, eg:
{ 

    "AAD_ApplicationId": "f3adada9-c73e-4b86-b30e-c86bc6ce0a93", 

    "AAD_AdditionalAudience": "https://contoso.com/AlvaoRestApiReports", 

}

  1. Open AlvaoRestApiReports/v1/systemSettings (eg. https://contoso.com/AlvaoRestApiReports/v1/systemSettings) in a browser and check that addClientId in the response is set to AAD_ApplicationId from the previous step

  2. Do the same check for the /AlvaoRestApi, it should return clientId set in the AzureApplicationId property.

Load data to PowerBI report​

Follow on-premise procedure in Power BI report templates, connect your report to AlvaoRestApiReports (eg. https://contoso.com/AlvaoRestApiReports) app created in the previous steps.