Forum Discussion

AndrewJohnBenja's avatar
AndrewJohnBenja
Regular Visitor
8 years ago
Solved

Power BI Embedded Row Level Security

Hi,   My organisation is considering using Power BI and I have been tasked with looking into how we could integrate it into our solution. I have read a lot of online documentation and a fair few of...
  • v-jiascu-msft's avatar
    v-jiascu-msft
    8 years ago

    Hi Andy,

     

    Since the "App Owns Data" only use one Power BI account, we can't identify the end users (your application users) with Power BI accounts.

    1. No, the users are your application users. 

     

    2. In one words, there is only one Power BI account in this scenario. The end users are identified by the tokens. So it won't work here that we assign roles in Power BI Service. Please refer to: #considerations-and-limitations.

    >>>Assignment of users to roles within the Power BI service does not affect RLS when using an embed token.

     

    3. Yes, if we assign roles to users in the Service, they must be Power BI users. But this won't be necessary in this scenario. Please refer to the item 2 above for reasons.

     

    Best Regards,

    Dale

AndrewJohnBenja's avatar
AndrewJohnBenja
Regular Visitor
8 years ago

Hi,

 

Thanks for taking the time to reply, Much appreciated.

 

So, a few questions.

 

1. When generating an embed token via an embed token request, I have to supply a user and list of roles. Does that user have to exist in AAD?

2. Why do I need to supply a list of Roles with the embed token request? I have seen that roles are created and users are assigned to those roles through the power BI desktop/portal

3. When assigning users to roles through power BI, does that user have to exist in AAD?

 

Many Thanks

 - Andy

v-jiascu-msft's avatar
v-jiascu-msft
Microsoft Employee
8 years ago

Hi Andy,

 

Since the "App Owns Data" only use one Power BI account, we can't identify the end users (your application users) with Power BI accounts.

1. No, the users are your application users. 

 

2. In one words, there is only one Power BI account in this scenario. The end users are identified by the tokens. So it won't work here that we assign roles in Power BI Service. Please refer to: #considerations-and-limitations.

>>>Assignment of users to roles within the Power BI service does not affect RLS when using an embed token.

 

3. Yes, if we assign roles to users in the Service, they must be Power BI users. But this won't be necessary in this scenario. Please refer to the item 2 above for reasons.

 

Best Regards,

Dale

  • AndrewJohnBenja's avatar
    AndrewJohnBenja
    Regular Visitor
    8 years ago

    Excellent. That answers my questions perfectly. 

     

    Much Appreciated

     - Andy

    • Podiumbi's avatar
      Podiumbi
      Frequent Visitor
      3 years ago

      In the Power BI embed solution I built I am using the Master User Approach.  This master user has full access to all reports in the Power BI tenant.  This means I only need one Power BI license.

       

      Users to the application are setup in Azure, these can be internal or external users.  If you already have a list of users from another system you can do a bulk upload of users into Azure so this isn't an issue.

       

      When users login to my app they are authenticated against Azure, once they are verified you have all the information needed for Row Level Security (RLS) to
      only show the user the data they are allowed to see.


      I have posted some examples:

      https://www.podiumbi.com/powerbi-reporting-software/