Forum Discussion

CoulterJames2's avatar
CoulterJames2
Advocate II
2 years ago
Solved

Implement Power BI Embedded with RLS

I am working with a clientwho wants to share a Power BI report with users outside their organisation using Power BI Embedded. The customer is a supplier of materials to the healthcare industry and th...
Need Help
Tutorial Requests
CoulterJames2's avatar
CoulterJames2
Advocate II
1 year ago

Hi lherbert501 I did get this working in the end, but as you have found, the official MS documentation can be a bit unclear at times. Firstly, your semantic models and reports have to be deployed to the Embedded capacity. Secondly, assuming your web app (in which the Power BI reports are going to be displayed) handles user login and authentication, you need a means of associating the logged in user with the data in your model that requires filtering. In our case, we wanted to show a customer spending report in which the content was filtered by customer ID. We had two options: we could either create a table in the data model that had a list of web app logins and the associated customer ID, then pass the user ID in the API request and use that to filter the report, or since the user and customer details already existed in the web app back end, we just passed the customer ID itself as the USERNAME() in the DAX expression to filter the customer table. 

 

Also, you will first need get a access token using the Service Principal credentials, passing in the client ID and client secret which you get from Azure AD/Entra ID:

 

GET: https://login.microsoftonline.com/{tenant ID}/oauth2/v2.0/token 

 

Once you get the token back, that needs to be included as the bearer token in subsequent API calls to the Power BI service.

To generate an embed token to display the report, you need to call GenerateToken endpoint with a JSON body looking something like this:

 

{
   "accessLevel": "View",
     "allowSaveAs": false,
   "identities": [
            {
                  "username": "{value passed in from web app that will be used to filter the table}",
                  "roles": ["{name of dynamic RLS role"],
                  "datasets": ["{semantic model ID"]
            }
      ]
}
 
I hope that helps
lherbert501's avatar
lherbert501
Post Prodigy
1 year ago

Hi CoulterJames2 ,

 

Wow that's amazing, thanks so much for that.

 

Was there any steps or videos that you used that could help?

 

I'm looking at doing the same but with e.g an email log in that I create per customer which would be the log in which is passed through the url to filter the report.

 

I'm just a bit confused with the steps, so I have the report, with a test RLS set up, but what is the next step I guess straight after that.

 

Thanks for your reply