Access Token Scope Issue in Azure AD and Power - azure

Question

I'm working with Power Bi REST APIs, for which I need an azure ad token.
I have set up an app in Azure AD, and have configured it as.
a. I intend to use that access token in my react app so I have configured it as SPA.
b. i have allowed public-client flow.
** I hv not checked 'access token' and 'id token' checkboxes as I'm using msal 2.0.
c. also have specified redirect uri as http://localhost:4200
d. also have given it all the permission I need to access my powerbi content (I need 'Dataset.ReadWrite.All)
THESE ARE MY AZURE APP ENDPOINTS
I HAVE SET MY REACT APP AS:
I'm using #azure/msal-browser and #azure/msal-react libraries.
This is my msalConfig object-
const configuration: Configuration = {
auth: {
clientId: "myclientidhere",//,
authority: "https://login.microsoftonline.com/mytenantidhere",
redirectUri: "http://localhost:4200/",
},
cache: {
cacheLocation: "localStorage",
storeAuthStateInCookie: false,
},
}
and, this is my scope:
export const loginRequest = {
scopes: ["Dataset.ReadWrite.All"]
};
after i run my app i see the auth popup. i put my credentials in it. and suddenly it throws this error-
invalid_client: AADSTS650053: The application 'dashboard.xyz.work' asked for scope 'Dataset.ReadWrite.All' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. Contact the app vendor. Trace ID: 77e47883-fdd3-444a-bdd3-9f3a53bc1500 Correlation ID: aa77d724-0d9f-41aa-8e47-251c6b6f9293 Timestamp: 2023-02-09 13:51:46Z
i have granted the same permission in my azure ad app. however my app has not been granted 'admin consent' but as a user my account has the permission to use this scope in powerbi.
NOTE: if I change my scope to 'user.read' or any other ms graph API resource, then I'm able to get an access token of that scope to access graph API resource. but I'm not able to get an access token to access my powerbi resources.
EVERYTHING LOOKS GREAT IN AZURE AD.
I READ IT SOMEWHERE THAT THIS RESOURCE '00000003-0000-0000-c000-000000000000' indicates to the graph.microsoft.com resource. and I'm hitting https://login.microsoftonline.com/{myTenantId} . these are my app endpoints.
I'm not sure if powerbi resources come under graph.microsoft.com ('00000003-0000-0000-c000-000000000000) resource!!??
also on my app's API permissions page I read, they come under https://analysis.windows.net/powerbi/api that is 00000009-0000-0000-c000-000000000000??
am I hitting the wrong endpoint or the issue is something else??

Answer 1

I tried to reproduce the same in my environment and got the same error as below:
To resolve the error, try the below:
I created an Azure AD SPA Application and added API permissions:
Note: Make sure to give scope as
https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All to access PowerBI content
I generated the auth-code by using below endpoint:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All
&state=12345
&code_challenge=codeChallenge
&code_challenge_method=S256
As admin consent is not granted to the API permissions, you will get the consent screen as below:
The auth-code got generated successfully without any error as below:
Now, I generated access token by using below parameters:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
grant_type:authorization_code
client_id:ClientID
scope:https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All
code:code
redirect_uri:https://jwt.ms
code_verifier:S256
The access token generated successfully with the scope Dataset.ReadWrite.All like below:
To resolve the error, modify the code as below:
export const loginRequest = {
scopes: ["https://analysis.windows.net/powerbi/api/Dataset.ReadWrite.All"]
};
If still the issue persists, try scope as https://analysis.windows.net/powerbi/api/.default.