Audience in an HTTP request via Active Directory OAuth

[Nolock]

Hi,

I'd like to automate some tasks in Power BI Service. Unfortunately, there is only a simple connector for Power BI. It means I have to write my own custom connector or create some HTTP request by myself (https://docs.microsoft.com/en-us/rest/api/power-bi/). That's ok for me.

But the problem is: I've registered an app in Azure and got client ID and client secret. But if I want to create an HTTP request with Active Directory OAuth, there is a field I don't understand: audience. I wasn't able to find out what I should write in. Does anybody have an idea what the field is for and what should be there?

Thank you for every hint.

[v-litu-msft]

Hi @Nolock,

You can have a try with:

https://graph.microsoft.com

There has a blog about Graph call, maybe it could help you something:

https://powerusers.microsoft.com/t5/Power-Automate-Community-Blog/The-Sweetest-Graph-Call-You-ve-Eve...

Best Regards,
Community Support Team _ Lin Tu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Nolock]

Hi @v-litu-msft,

thank you very much for your answer. Unfortunately, it didn't work 😞

In some resource they use a URI, sometimes a GUID like here. The definition from the link says: "The GUID for the target resource that you want to access, which is the client ID from the application identity for your web app or API app."

I've tried everything possible, nothing works 😞

[Amino0]

In case someone is still stuck with this error. The Audience should be one of the below

'https://service.flow.microsoft.com/'

'https://management.core.windows.net/'

'https://management.azure.com/'

'https://service.powerapps.com/'

'https://service.kratosapps.com/'

'637fcc9f-4a9b-4aaa-8713-a2a3cfda1505'.

The Audience is the API which your custom authentication App has permissions on. To get this URL, navigate to Azure AD --> App Registration, then select your custom authentication App, and click on API Permissions. Hereafter, select API / Permissions name which should pop up the permission details along with the used API. For example, https://service.flow.microsoft.com/Approvals.Manage.All . In this case, the Audience is https://service.flow.microsoft.com/  

[Amino0]

In case someone is still stuck with this error. The Audience should be one of the below

'https://service.flow.microsoft.com/','https://management.core.windows.net/','https://management.azure.com/','https://service.powerapps.com/','https://service.kratosapps.com/','637fcc9f-4a9b-4aaa-8713-a2a3cfda1505'

The Audience is the API which your custom authentication App has permissions on. To get this URL, navigate to Azure AD --> App Registration, then select your custom authentication App, and click on API Permissions. Hereafter, select API / Permissions name which should pop up the permission details along with the used API. For example, https://service.flow.microsoft.com/Approvals.Manage.All. In this case, the Audience is https://service.flow.microsoft.com/ 

[tony_hernandez]

Updating this post. Easiest way to find your audience in 2021 is to go to:

AAD > App Registration > Select App > API Permissions > Click the Top level item of a permission (i.e. Microsoft Graph) > When the Library opens you should see the an HTTPS address below the Name label. This is your API audience.

[seadude]

Hm. I'm not able to get this to work: 

- Registered app in AAD:

- Setup HTTP action accordingly

Results:

Any ideas on what I'm missing?

[swiftinitdotcom]

I have exactly same issue-Http request failed as there is an error getting AD OAuth token: 'AADSTS500011: The resource principal named "https://service.flow.microsoft.com" was not found in the tenant named swiftinit. This can happen if the 

[wab]

Did you managed to find a solutions?

[IHPROLAN]

Hello, I am also having trouble using the OAuth. I get the same error. Is there any solution on that?

[WillPage]

I came across this topic while searching for the answer to what to put in the Audience field in the Authentication object. I found this works for the Power BI API. Note there is no trailing / character, which exists in the API permissions in the App Registration:

https://analysis.windows.net/powerbi/api

[wab]

The solution is to make sure you added the api that you created in Azure to security group. That group also need to be allowed to use service principals and need to be added to environment as Member. 

[slx299]

Hi 

We're using similar set-up but continuously getting redirect error

Any idea? 

{

"statusCode": 302,

"headers": {

"x-ms-proxy-app-id": "2cff5b2f-XXXX",

"x-ms-proxy-group-id": "e4a5613f-XXXX",

"x-ms-proxy-subscription-id": "f05d05b1-XXXX",

"x-ms-proxy-transaction-id": "b78db4ca-XXX",

"x-ms-proxy-service-name": "proxy-appproxy-FRC-XXX3",

"x-ms-proxy-data-center": "FRC",

"Nel": "{\"report_to\":\"network-errors\",\"max_age\":86400,\"success_fraction\":0.2,\"failure_fraction\":1.0}",

"Report-To": "{\"group\":\"network-errors\",\"max_age\":86400,\"endpoints\":[{\"url\":\https://ffde.nelreports.net/api/report?cat=proxy-appproxy-FRC-PAR03P-3\}]}",

"Location": https://login.microsoftonline.com/XXX/oauth2/authorize?response_type=code&client_id=XXX&scope=openid...,

"Set-Cookie": "AzureAppProxyPreauthSessionCookie_XXXXd_1.4=4|YCE4Hcw8OHX88FyfQ0XHyK+nRvRAX+Iij3lcIlVNIcfUjxC4/sBKpmCfbf0eF8FCfwMcucU269zfDGwhK44Zf+ZgiREzc5pOMBY0vG1O1nA2yaxmYNlvVzBSQ7RY+y/0j9Qh1w8vW5wPHIz5EsjQwHkuw5O2aUI4kcPqJ3NTFgQkyMjiCkEpfpJBF5ZfFMz7bFJmYZFKa3gcerGFE9sSTxJJXVKS49gqk/gOahVLO6aiS9DqPcvw2CROXaY0fx3VCwkH/T6bDBjrWoy6UAzgFgvzsOrjy4Vj9DseZL6JkFA=; expires=Thu, 20 Apr 2023 15:40:25 GMT; path=/; Secure; SameSite=None,AzureAppProxyAnalyticCookie_2cff5b2f-a47f-4211-972c-47756d35b164_https_1.3=4|S5I5lk58QFcl9UPrvJ8DZ7kGEieOSYuXhIrhLdzHt9e+hTyToDiHxtpb+uhZaeeHCXhMl0LiIe5Tajyb+jo40T5GGR8R9YbMriGLh81b4iCc9pWUkGtErQbQQ/Ffmi9ePetBkfIA87iiPGkLSPl6LQ==; path=/; Secure; SameSite=None",

"Date": "Thu, 20 Apr 2023 15:30:24 GMT",

"Content-Length": "0"

}

}

thank you

[dan-data-cescoe]

yes, this worked

[WillPage]

@slx299The URL it's trying to redirect you to is the user-interactive M365 login page. Check your app registration settings in Entra ID.

[MelMacLondon]

Thank you !!! 

https://service.flow.microsoft.com/

Works for Power Automate Flow.