Power BI Embedded with Row-Level Security?

Thanks higgim, that makes sense.

I'm confident that RLS is coming, soon enough, to Power BI Embedded.

What I wish I could find out now is how RLS/authentication will work, and whether there is an API for user management, so that we can automatically sync users of our client portal to Power BI Embedded users.

This says that Power BI Embedded and its "app token" model "does not require your app to use Azure Active Directory for user authentication and authorization, although you can do this."

So, I'm guessing that RLS for Power BI Embedded will mean setting up RLS roles/rules, and then adding Azure AD users as members to those roles. Then, the Power BI Embedded app token API will be extended to include an Azure AD user ID, or user name, so that Embedded knows how to apply RLS.

Can anyone from Microsoft confirm that the above is what will be released?

Then, our app—our "client portal"—does not use Azure Active Directory for user authentication and authorization. But I'm hoping that Azure AD has an API that would allow us to automatically sync our Azure AD with our set of client portal users. (Then, we could store each user's Azure AD user ID/user name in our client portal, in order to pass it along with the app token.)

Azure Active Directory Graph API appears to be such an API, for managing users in Azure AD. Right? Assuming RLS for Embedded will work as I have guessed at (above), then would anyone agree, or disagree, that using the Azure AD "Graph API" is a good solution for syncing Azure AD with our client portal users, to enable the passing of app tokens that include the Azure AD user ID/user name?

I wish I had the patience to "just wait and see," but we would really like to understand how Power BI Embedded with RLS will work, ASAP, in order to move forward with implementing Power BI across our organization -- as both an internal BI solution, and as a way to provide reports to our clients. Thanks!