Datasets - Execute Query endpoint with RLS

Hi, sorry for the long time to response. 
None of those solutions worked for me 😞 

Into my embedded report, the RLS works fine, the problem is just about the execute queries. 

My steps:

1 - Generate a authentication token by service principal and master user (the both not work)
2 - Get the token from the step 1 and call the api generate token:

POST:https://api.powerbi.com/v1.0/myorg/GenerateToken
{
  "datasets": [
    {
      "id": "xxx-xx-xxxx"
    }
  ],
  "targetWorkspaces": [
    {
      "id": "xxx-xxx-xxxx-xxx"
    }
  ],
  "identities": [
    {
      "username": "usernamexxx",  
      "roles": ["rolexxx"],     
      "datasets": ["xxxx-xxx-xxxx"]
    }
  ]
}

3 - Get the token from step 2 and execute querie:

POST: POST https://api.powerbi.com/v1.0/myorg/datasets/{datasetId}/executeQueries
BODY example:
{

  "queries": [

    {

      "query": "EVALUATE VALUES('mytable')"

    }

  ],

Hi marcio_fornari.,

Thank you for the update, and I appreciate your continued patience.

You are correct. The Execute Queries REST API does not enforce RLS by default as it does when a user views the report in the Power BI Service. The identities field can simulate RLS only under certain conditions, such as:

• The dataset is hosted in a Premium (P or A SKU) or Microsoft Fabric capacity workspace not in Pro-only workspaces.
• The username and roles fields in the payload must exactly match your RLS configuration expectations.
• The RLS role must correctly use USERPRINCIPALNAME() or USERNAME().
• A valid Azure AD token must be used with the appropriate dataset permissions.

If all these conditions are met and RLS is still not being applied, it is essential to understand that RLS simulation via API has limitations and may not behave exactly like the Power BI Service.

• Verify Workspace Capacity: Ensure that the dataset is located in a Premium or Fabric capacity workspace.
• Test RLS Simulation: As an alternative, you can test RLS directly in the Power BI Service using "Test as Role" to verify the logic.
• Explore Other Options: If enforcing RLS via API is essential, consider using embedding scenarios with effective identity, designed for secure per-user data access in embedded analytics.

If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.

Thank you again for reaching out on the Microsoft Community Forum.