Forum Discussion
Resolver IDax - Execute Queries/RLS
Yes — the Execute Queries API supports this directly, and it's the standard way to get RLS-aware DAX results for embedded users who don't have a Power BI account.
The request body takes an 'identities' array alongside your 'queries' array. Each identity object carries a 'username' (any string identifying the end user — it doesn't need to be a real UPN) and a 'roles' array naming the RLS role(s) from your model to apply. That's the same effective-identity mechanism Embedded uses for embed tokens, just passed to Execute Queries instead.
So your body becomes something like { "queries": [...], "identities": [ { "username": "someuser", "roles": ["YourRLSRoleName"] } ] }. The DAX query then runs as if that user were logged in and subject to that role's filter.
One thing worth double-checking: if your RLS rule expressions read USERNAME() vs CUSTOMDATA(), make sure you're populating the matching field on the identity object — username feeds USERNAME()/USERPRINCIPALNAME(), and there's a separate 'customData' property on the identity if your rules use CUSTOMDATA() instead.
Community SupportHi marcio_fornari ,
Thank you for reaching out to fabric community.
For Power BI Embedded (App owns data), the recommended approach is to generate the embed token with an EffectiveIdentity, passing the user's username and the RLS role:
{ "username": "user123", "roles": ["MyRLSRole"], "datasets": ["dataset-id"] }
The embedded user doesn't need a Power BI account. Power BI will apply the RLS role when querying the semantic model.
However, you can't pass the RLS role + username to the Execute Queries API using a service principal in the same way. impersonatedUserName has separate authentication/permission requirements and isn't a replacement for Embedded EffectiveIdentity.
Thanks!!