How to Get Power BI Access Token

Getting a Power BI access token is the first step toward unlocking the full power of its API and embedding capabilities. Whether you're building a custom application, automating routine tasks, or embedding reports into your company's portal, you'll need this digital key. This guide breaks down the process step-by-step so you can generate the credentials you need and get back to building.

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

What is a Power BI Access Token, Anyway?

Think of an access token as a temporary keycard for a secure building. Instead of giving an application your permanent username and password (which would be a huge security risk), you provide it with an access token. This token, issued by Azure Active Directory (Azure AD), grants the application specific, limited permissions for a short period.

This whole process is governed by a security standard called OAuth 2.0. The goal is to allow one application (yours) to securely access resources hosted by another (the Power BI Service) on your behalf, or as the application itself, without ever sharing your actual credentials.

You'll need an access token to:

• Embed reports and dashboards into custom web applications, portals, or SharePoint.
• Automate tasks using the Power BI REST API, such as triggering dataset refreshes, managing workspaces, or cloning reports.
• Develop custom visuals that need to interact with Power BI services.

Before You Begin: Prerequisites

Before you jump into the Azure portal, make sure you have everything you need. This will save you from hitting roadblocks later.

• A Power BI Pro or Premium Per User (PPU) license: You need a professional account to work with most API and embedding features.
• An Azure AD Tenant: If your organization uses Office 365 or Power BI, you already have one. This is the directory that manages users and application permissions.
• Admin Permissions: You'll need permission to register an application in Azure AD. If you don't have this, you might need to grab a coffee for your IT administrator and ask for their help. For certain configurations, a Power BI admin will also need to enable specific service principal settings.

Your Step-by-Step Guide to Getting a Power BI Access Token

The process involves two main parts: first, registering your application in Azure AD to establish its identity, and second, using that identity to programmatically request a token. Let's walk through it.

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

Step 1: Register an Application in Azure AD

Your application needs an official identity within your organization's Azure environment before Microsoft will even consider giving it a token. This is called an "app registration."

1. Navigate to the Azure Portal and sign in.
2. In the search bar, type "Azure Active Directory" and select it.
3. From the left-hand menu, select App registrations, then click + New registration.
4. Name your application: Choose something descriptive, like "My Power BI embed App" or "Automated Refresh Script".
5. Supported account types: For internal apps and automation, the most common choice is "Accounts in this organizational directory only (Single tenant)".
6. Redirect URI (Optional but Recommended): This is where Azure AD will send the security token after a user successfully authenticates. Even for backend apps, it's good practice to set one up. For development and testing, you can use:
7. Click Register to create the application.

Once your app is registered, you'll be taken to its overview page. You need two crucial pieces of information from this screen. Copy and save them in a safe place, like a password manager or text file for now.

• Application (client) ID
• Directory (tenant) ID

Step 2: Configure API Permissions

Now that your app has an identity, you have to tell Azure AD what it's allowed to do within Power BI.

1. From your app registration's menu, click on API permissions.
2. Click + Add a permission.
3. From the list of Microsoft APIs, find and select Power BI Service.
4. You'll now be asked what type of permission your application requires. This is an important choice:
5. For a common use case like embedding reports for internal users, select Delegated permissions. Browse and select the permissions you need. Good starting points include:
6. Click Add permissions.

For some permissions, especially Application permissions, you (or an admin) must press the Grant admin consent for [Your Tenant Name] button on the API permissions screen to approve them for the entire organization.

Step 3: Create a Client Secret

The client secret is essentially the application's password. It's used along with the Client ID to prove your application's identity when it's requesting a token for itself (not on behalf of a user).

1. In your app registration menu, click on Certificates & secrets.
2. Select the Client secrets tab and click + New client secret.
3. Give it a short description (e.g., "power-bi-automation-secret") and choose an expiration period.
4. Click Add.

This is important: The secret's value will be shown on the screen only once. Copy it immediately and store it securely with your Client ID and Tenant ID. If you navigate away from this page, you will never be able to retrieve it again and will have to create a new one.

Acquiring the Token with Code

With your app configured, you're ready to request a token. The best way to do this is with the Microsoft Authentication Library (MSAL), which handles the complex security flow for you. Below are two common examples using Python and PowerShell.

Graphed

Build AI Agents for Marketing

Build virtual employees that run your go to market. Connect your data sources, deploy autonomous agents, and grow your company.

Build Your First Agent

Example 1: Getting a Token for an Application (Python)

This method is ideal for backend automation (e.g., a script that refreshes a dataset every night). It uses the app's Client ID and Client Secret to authenticate. This requires that you use Application permissions.

First, install the Python MSAL library:

pip install msal

Then, use this script, replacing the placeholder values with the credentials you saved earlier.

import msal
import json

# Your App's details
tenant_id = "YOUR_TENANT_ID"
client_id = "YOUR_CLIENT_ID"
client_secret = "YOUR_CLIENT_SECRET"  # Make sure to use the secret's "Value"

# The scope defines that we want a token for the Power BI API
scope = ["https://analysis.windows.net/powerbi/api/.default"]

# Construct the authority URL
authority = f"https://login.microsoftonline.com/{tenant_id}"

# Create a confidential client application
app = msal.ConfidentialClientApplication(
    client_id,
    authority=authority,
    client_credential=client_secret
)

# Acquire a token for the app
result = app.acquire_token_for_client(scopes=scope)

if "access_token" in result:
    access_token = result['access_token']
    print("Successfully acquired access token!")
    # print(f"Token: {access_token[:30]}...") # Uncomment to see the first 30 chars
else:
    print("Error acquiring token.")
    print(result.get("error"))
    print(result.get("error_description"))

AI Agents for Marketing

Crash Course

Graphed

Free PDF · the crash course

AI Agents for Marketing Crash Course

Learn how to deploy AI marketing agents across your go-to-market — the best tools, prompts, and workflows to turn your data into autonomous execution without writing code.

Download the PDF

Example 2: Getting a Token for a User (PowerShell)

This method is for when you need a token on behalf of a user who can sign in interactively. It's perfect for admin scripts or testing delegated permissions. When you run this, a browser window will pop up asking you to sign in to your Microsoft account.

First, install the MSAL PowerShell module:

Install-Module -Name MSAL.PS -Scope CurrentUser

Then, run this script in your PowerShell terminal:

# Import the module
Import-Module MSAL.PS

# Your app's details
$clientId = "YOUR_CLIENT_ID"
$tenantId = "YOUR_TENANT_ID"

# The scope for Power BI API
$scopes = @("https://analysis.windows.net/powerbi/api/.default")

# Request the token. This will trigger a browser login prompt.
$tokenResult = Get-MsalToken -ClientId $clientId -TenantId $tenantId -Scopes $scopes -Interactive

# Display the token
if ($tokenResult) {
    Write-Host "Successfully acquired token!"
    $accessToken = $tokenResult.AccessToken
    Write-Host "Access Token (first 30 chars): $($accessToken.Substring(0, 30))..."
} else {
    Write-Host "Failed to acquire token."
}

How to Use Your Token

Once you have your access token, you include it in the Authorization header of any API request you make to the Power BI Service. The format is a "Bearer" token:

Authorization: Bearer <YOUR_LONG_ACCESS_TOKEN_HERE>

Now you're ready to start building!

Final Thoughts

Getting a Power BI access token involves setting up your application's identity, defining what it can do, and then writing a bit of code to request the key. While the process is powerful, it’s a detailed journey through the depths of Azure AD that isn't for everyone.

Here at Graphed, we believe data analysis should be fast and intuitive, not blocked by security protocols and authentication schemas. Instead of wrestling with client secrets and API permissions, we built Graphed to connect directly to all your data sources so you can use simple, natural language to get the reports you need in seconds. If you'd rather spend your time acting on insights than writing code to access them, we can help turn hours of manual setup into a 30-second conversation.