¶ 1. Summary
The provided content details a step-by-step guide to create an application in Power BI, configure Azure Active Directory, create a workspace in Power BI, and configure integration in T6 Planning. It includes detailed instructions with screenshots on how to perform these tasks, including application creation, access setup, group creation, permission management, and integration parameter setup for the T6 Planning product.
For On Premise integration, with customer-owned licensing, a Power BI Embedded or Power BI Premium license is required, as described by Microsoft at the following link: Power BI | Microsoft.
¶ 2. Create an Application in Power BI
- Access https://app.powerbi.com/Apps.
- Sign in with the registered account.
- Click Next.
- Fill in the form fields:
- Application Name: PBI
<Client> <ENVIRONMENT>
E.g.: PBI CustomerName PRD - Application Type: Native (for apps that run on client devices, such as Android, iOS, Windows, etc.)
- API Access: Select all
- Application Name: PBI
- Click Register. Save the Application ID value.
¶ 3. Azure Active Directory (AAD)
-
Access AAD in the Azure Portal https://aad.portal.azure.com.
-
Access App Registrations:
- Click Azure Active Directory.
- Click Applications.
- Click App Registrations.
- Click All Applications.
- Type the application name created in Power BI.
- Click the application.
Power BI Application -
Create the Service Principal:
- Save the Directory (tenant) ID value.
- Click Create Service Principal.
Create Power BI Service Principal -
Create the Secret:
- Click Certificates & Secrets.
- Click Client Secrets.
- Click New client secret.
- Enter a Secret name similar to the Power BI app. E.g.: PBI Client PRD Secret
- Select 730 days (24 months).
- Click Add.
Create Power BI Secret -
Save the newly created Secret:
- Save the Secret Value.
Save Power BI Secret -
Access the Groups screen and start creating a new group:
- Click Group.
- Click All groups.
- Click New group.
Create New Power BI Group -
Create a new Group:
- Select Group type as Security.
- Enter a Group name similar to the Power BI app. E.g.: PBI CustomerName PRD Group
- In “Azure AD roles can be assigned to the group” select Yes.
- Click Create.
Power BI Group Setup -
Access the newly created group at Groups > All groups > (search by name).
-
Add a member to the group:
- Click Members.
- Click Add members.
- Search for the application name created in section 2. E.g.: PBI CustomerName PRD
- Click the application name found.
- Click Select.
Add Member to Power BI Group
¶ 4. Create a Workspace in Power BI
-
Access https://app.powerbi.com.
-
Create a new workspace:
- Click Workspaces.
- Click + New workspace.
Create New Power BI Workspace -
During workspace creation, select License mode: Embedded and select the Capacity.
License mode and Capacity Setup -
Add the group created in section 3 to the workspace, with Admin role:
- Access the newly created workspace.
- Click the three dots (...) to show all options.
- Click Manage access.
Manage Power BI Workspace Access - Click + Add people or groups.
Add People or Groups to Power BI Workspace - Search for the group created in section 3. E.g.: PBI CustomerName PRD Group
- Select Admin role.
- Click Add.
Add Group to Power BI Workspace -
Get the Workspace Group ID. Access the workspace in Power BI (https://app.powerbi.com)
- Save the Workspace Group ID value.
Power BI Workspace Group ID
¶ 5. Configure Integration in T6 Planning
-
Access the T6 Planning application.
-
Access the Parameters menu and then Integration.
Configure Integration in T6 Planning -
Configure integration:
- Report - Client Secret: Secret Value (Obtained in section 3)
- Report - ClientID: Application ID (Obtained in section 2)
- Report - GroupID: Workspace Group ID (Obtained in section 4)
- Report - Integration: Yes
- Report - TenantID: Directory (tenant) ID (Obtained in section 3)
- Report - API URL: https://api.powerbi.com/
- Report - Authorization URL: https://login.microsoftonline.com/{0}
- Report - Resource URL: https://analysis.windows.net/powerbi/api
¶ 6. Troubleshooting
If Power BI integration returns an authorization error (especially 401/403), validate the items below in this order (from most likely to “it was working and suddenly stopped” scenarios):
-
Service Principal access to the workspace (most common cause):
- Power BI Service → open the workspace from
PowerBIGroupId→ Access / Manage access. - Confirm whether the Service Principal (or its security group) is still assigned as Admin, Member, or Contributor.
- If it was removed (access cleanup, workspace recreation, etc.), add it again.
- Power BI Service → open the workspace from
-
Power BI tenant configuration:
- Power BI Admin Portal → Tenant settings → Developer settings → Allow service principals to use Power BI APIs.
- Check whether it is still enabled.
- If restricted to specific groups, confirm the Service Principal group is still in the allowed list and was not moved to exclusion.
-
Workspace capacity/license:
- Admin Portal → Capacity settings (or in the workspace, diamond icon).
- Confirm the capacity (Premium, Embedded, or Fabric) is active, not paused or expired.
- For paused Embedded (A SKU) capacity in Azure, embed commonly fails and returns
401/403.
-
Workspace/GroupId still exists and is valid:
- Confirm the workspace from
PowerBIGroupIdwas not deleted. - If the workspace was recreated, there will be a new
GroupId, and the parameter in T6 must be updated. - Confirm the expected reports are still inside this workspace.
- Confirm the workspace from
-
Service Principal sign-in logs (exact root cause diagnosis):
- Entra ID → Sign-in logs → Service principal sign-ins tab.
- Filter by the application
ClientID. - Use the failure reason to identify exactly what is blocking access to Power BI.
-
API permissions in App Registration:
- Microsoft Entra ID → App registrations → application → API permissions.
- Confirm Power BI Service permissions are still granted with admin consent (green status).
¶ 7. Q&A
Frequently Asked Questions
1. Integration was working and suddenly started returning 401/403. What should I check first?
First, check whether the Service Principal (or its group) still has access to the PowerBIGroupId workspace. This is the most common cause when integration “suddenly stops” without an apparent T6 change.
2. How can I tell if the issue is a Power BI tenant policy?
In the Power BI Admin Portal, validate Allow service principals to use Power BI APIs under Tenant settings > Developer settings. If there is group-based restriction, confirm the Service Principal group is still allowed.
3. Can a paused capacity cause embed failures?
Yes. When workspace capacity is paused, expired, or unavailable (especially Embedded A SKU), embed can fail with 401/403.
4. What happens if the workspace is recreated?
Recreating a workspace generates a new GroupId. In this case, you must update the Report - GroupID parameter in T6 Planning to point to the new workspace.
5. Where can I find the exact technical reason for authentication failure?
In Entra ID, go to Sign-in logs > Service principal sign-ins and filter by ClientID. The log shows timestamp and reason for each authentication failure.
6. Which permissions must remain granted in App Registration?
Power BI Service API permissions must remain configured and granted with admin consent (green status); otherwise, calls may be blocked.