How to integrate Power Bi into ForceManager
🔗 This feature is available for all plans.
For detailed information about each plan, you can check it out 👉 here.
Power BI integrates comprehensive, interactive, and real-time insights directly into ForceManager.
Let's dive into how you can integrate Power BI seamlessly and enhance ForceManager's functionality.
Prerequisites
Before you begin, ensure you have:
A Microsoft Entra tenant and a master organizational user.
A Power BI Pro account.
These elements are crucial for a smooth integration process, allowing you to manage and deploy Power BI solutions effectively.
Click on the following links if needed.
Considerations
Power BI embedded analytics offers two solutions:
Embed for your customers
Embed for your organization
The embed for your customers solution allows you to build an app that uses non-interactive authentication against Power BI. Your customers are likely to be external users, and they don't need to sign in using Power BI credentials to view the embedded content.
The embed for your organization solution allows you to build an app that requires signing in using Power BI credentials. Once signed in users can only consume embedded content, they have access to on Power BI service. This solution is aimed at large organizations that are building an app for internal users.
Having said that, it is clear that:
The embed for your customers method should be only used to expose data to customers, that is, no sensible or secret data that should stay within the intranet of the company or behind a per user auth system. On the other side, this method is the only one tht allows to use an automatic authentication system (service principal or master user) without requiring single user to authenticate themself.
The embed for your organization on the contrary method is intended to be used for internal users, however users must authenticate with their Microsoft Entra ID, so making the auth process not smooth. Honestly it is not known if there is a seamless/silent version for this type of login, but for what it had been investigated, there are no ways for supporting an embedded autologin that will leverage a sort of grant, out of the MS direct SSO scope, based on an auth process that occurred in the app that hosts the embedded report.
So, we'll put our attention now on the way in which the embed for your customers can be setup to implement a PowerBI embeeded report in a web app without requiring extra authentications.
Embed content for customer
The documentation to follow is here.
TL;DR; what ForceManager customer would be required to provide to ForceManager, when letting a PowerBI report to be accessed within ForceManager are the following infos:
clientId , workspaceId , reportId , clientSecret , tenantId .
Then, internally in its Azure tenant, ForceManager customers needs to follow a series of step to generate that infos and configure their own PowerBI and Azure app to be capable of sharing reports data.
To create an embed for your customers sample app, a ForceManager customer must follow these steps:
Select your authentication method
The method to be used is the service principal one, the one that basically allows an app to Entra ID to authenticate your app. After it's authenticated, the app can access Microsoft Entra tenant resources. This kind of method lets an app to interact via API with MS basically, that's why it does not require a per user auth to access the report.
Register a Microsoft Entra application
The core element to expose a report (literally a workspace of PowerBI) is to create first an application with Microsoft Entra ID.
To this it is just needed to follow the instructions in Register your application. It is possible to create it manually or automatize it, via the Power BI embedded analytics setup tool which is quite powerful. The automatic tool basically present a step-by-step process that the user can follow to create an embed for your customers app.
The setup require to:
Choose as embedding solution the "Embed for your customers" one
Step 1 - Sign in to Power BI with your master (PowerBI Pro) user
Step 2 - Register your application
giving an app name (e.g. Test PowerBI Embedded Reports );
specifying API accesses. For this scope it is enough to give the permission Read all reports
Select Register.
Step 3 - Creating a workspace
Your Microsoft Entra app Application ID is displayed in the Summary box. Copy this value for later use.
This is optional but if you have no existing reports it is good to create a workspace to assign them the newly report, since workspace is necessary to give to the app access to it such that it can load the embedded report in an external (web)app.
Step 4 - Importing content
It is optional and it can be skipped.
Step 5 - Grant permissions (Embed for your customers only)
This is done just pushing the corresponding button in the presented interface.
Select Grant permissions and in the dialog
select Accept.
This step allows your Microsoft Entra app to access the APIs you selected (also known as scopes) with your signed-in user.
This user is also known as the master user.
Once done this, on the left it appears an application ID that must be noted (e.g. 4e9ead49-8c6c-4e6d-b98f-25f88861b74f ).
Step 6 - Setup your environment
Power BI Embedded Analytics caters to different needs, including embedding for customers ("App owns data") and embedding for your organization ("User owns data"). For this guide, we'll focus on the "Embed for your customers" method, perfect for delivering rich analytics without individual user logins.
Step 7 - Create and publish a Power BI report
Next step is to create a report and upload it to your workspace. You can create your own report using Power BI Desktop, and then publish it to your workspace.
For testing reasons it is possible to download predefined reports in the Power BI Desktop samples Github repository.
Step 8 - Get the embedding parameter values
To embed your content, you need to obtain certain parameter values. For the service principal authentication method you need:
Client ID: this is the application ID you already have.
Workspace ID: you can find the workspace ID in the Admin portal settings by selecting "Details" next to the workspace name. Alternatively, get the workspace ID GUID, sign in to Power BI service, open the report you want to embed. Copy the GUID from the URL. The GUID is the number between /groups/ and /reports/ .
Report ID: to get the report ID GUID, sign in to Power BI service.
Open the report you want to embed. Copy the GUID from the URL. The GUID is the number between/reports/ and /ReportSection.
Tenant ID: to get the tenant ID GUID, log into Microsoft Azure. Search for "App registrations" and select the "App registrations" link. Select the Microsoft Entra appyou're using for embedding your Power BI content, e.g.
Test PowerBI Embedded Reports . From the Overview section, copy the Directory (tenant) ID GUID.Client secret: this can be generated as usual from Azure, whitin the "Manage -> Certificates & secrets" section of the app (the app is again listed in the "App registrations" of Azure). Under "Client secrets," select "New client secret". In the "Add a client secret" pop-up window, provide a description for your application secret, select when the application secret expires (e.g. 2 years), and select "Add". From the "Client secrets" section, copy the string in the "Value" column of the newly created application secret. The client secret value is your client secret. Make sure you copy the client secret value when it first appears. After navigating away from this page, the client secret will be hidden and you'll not be able to retrieve its value.
Step 9 - Service principal API access
For a Microsoft Entra app to be able to access the Power BI content and APIs, a Power BI admin needs to enable service principal access in the Power BI admin portal.
This should be already enabled by default.
If it is not, follow these instructions to do it.
For a Microsoft Entra app to be able to access the Power BI content and APIs, a Power BI admin needs to enable service principal access in the Power BI admin portal. If you're not the admin of your tenant, get the tenant's admin to enable the Tenant settings for you.
In Power BI service, select Settings > Settings > Admin portal.( above)
Select Tenant settings and then scroll down to the Developer settings section.
Expand Allow service principals to use Power BI APIs, and enable this option.(below)
Step 10 - Enable workspace access
To enable your Microsoft Entra app access objects such as reports in the Power BI service, the service principal must be added as a member or admin to your workspace.
This is very important, otherwise the embedded report will not be shown due to an unauthorized error.
To do it:
Sign in to Power BI service.
Scroll to the workspace you want to enable access for, and from the "More menu",
select "Workspace access".
In the "Access pane", copy the service principal name, which is the name you gave your
Microsoft Entra app, e.g. Test PowerBI Embedded Reports .
Step 11 - Embed your content
If everything is configured correctly, you should be able to embed your report in a third-party app. Consider that Microsoft services can take a bit to propagate the different access (API, workspace, ...) so you could eventually experiment unauthorized issues in the short term.
When talking about embedding we mean in specific providing a UX in ForceManager to let our ForceManager customer to provide the embedding parameter values needed to let our FE/BE interact with Microsoft and Power BI such that a desired report will appear within ForceManager (web)app.
In this way the customer is able to consume PowerBI dashboards already created right from ForceManager.
During the development of the internal code it is possible to explore pre-existing PowerBI integration apps provided by Microsoft. There is a Power BI developer samples folder in Github that contains implementations of apps in different languages (Node, Python, Java, ...).