PBIRS On-Premises Licensing, Website Embedding, and SSO Requirements

Hi Jessica_17​,

Here is how I would frame each point for the client (please confirm licensing with your Microsoft licensing partner, since terms change):

Licensing. The server is licensed, not the viewers. Power BI Report Server rights come with either SQL Server Enterprise Edition per-core licences with active Software Assurance, or a qualifying Power BI Premium / Fabric capacity purchase. Report viewers do not need individual Power BI licences to view on-premises reports.

Embedding. PBIRS does not have the JavaScript embedding SDK that the Power BI service has. Embedding is an iframe with the embed parameter, so the React side is simple:

<iframe
  title="Sales"
  width="100%" height="800"
  src="https://reports.contoso.local/Reports/powerbi/Sales/Overview?rs:embed=true"
  frameBorder="0"
  allowFullScreen
/>

SSO and the website's own login. This is the hard part. PBIRS authenticates with Windows authentication (Kerberos/NTLM), and it cannot accept your website's session or JWT. In practice the clean options are:

A. Intranet, domain-joined users (best)
   -> site + PBIRS on the same domain, browser in Local Intranet zone
   -> Kerberos (SPNs + delegation if a proxy is involved) = no prompt

B. Website has its own login (non-Windows users)
   -> PBIRS cannot reuse that session
   -> map site users to AD accounts, or reconsider: paginated reports via
      custom auth extension, or Power BI Embedded (cloud) for app-owns-data

One NGINX-specific warning: NTLM is connection-based, and open-source NGINX does not keep the client-to-upstream connection pinned, so proxying PBIRS through NGINX with NTLM tends to cause repeated login prompts. Either let browsers reach PBIRS directly (only the site goes through NGINX), use Kerberos end to end, or use a proxy that explicitly supports NTLM pass-through.

Security. Manage access with folder-level roles (Browser for viewers) using AD groups, and filter data with RLS roles defined in the .pbix and assigned to AD groups in the report's Manage > Row-level security page.

So my overall approach would be:

Licence the server (SQL EE + SA or Premium/Fabric capacity rights)
-> iframe embed with ?rs:embed=true in React
-> Windows/Kerberos SSO for domain users; avoid NTLM through NGINX
-> AD groups for folder roles + RLS roles in the report
-> Non-Windows users: re-evaluate (custom auth / cloud embedding)

AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.

Hi Jessica_17​,

It helps to separate two databases here:

Report Server catalog (ReportServer + ReportServerTempDB) -> must be SQL Server
Report data sources (what the reports query)          -> can be PostgreSQL, MySQL, Oracle, files, etc.

The catalog, where the server stores reports, folders, permissions and subscriptions, has to be SQL Server. There's no supported way to run it on another database engine. The data your reports read from, though, can live in any supported source, so the client's actual data doesn't need to move to SQL Server.

On cost: the catalog is small and only used by the report server itself. Before assuming an extra SQL Server licence, ask the licensing partner whether the client's existing Power BI Report Server entitlement already covers a SQL Server instance used only for the catalog. That's the question that decides whether there's any added cost at all.

Hi Jessica_17​, good questions, short answers below:

Licensing: nothing runs in the cloud. Premium/Fabric or SQL Server Enterprise + Software Assurance is simply how you are entitled to the PBIRS product key. You enter that key during installation and the server works fully offline. Viewers need no individual licences. Your licensing partner can confirm which entitlement you already own.

Publishing: use Power BI Desktop optimized for Report Server and save with File > Save as > Power BI Report Server, entering your server URL (for example http://pbirs01/reports). That only writes to your server; avoid the regular Desktop "Publish" button, which targets the cloud service.

Login prompt when embedded: credentials should never be put in the website or iframe. The prompt appears because the browser is not doing integrated Windows authentication for that server. On domain-joined machines, add the PBIRS URL to the Local Intranet zone (via Group Policy), make sure Negotiate/NTLM is enabled in rsreportserver.config, and register Kerberos SPNs for the service account; users then open embedded reports with no prompt.

SSO with your website login: only works when that login is the same Windows/AD identity. If the site uses its own user store, PBIRS cannot reuse that session, so map users to AD accounts or consider another embedding option.

Docs to share with the client (search these titles on Microsoft Learn): "Find your report server product key", "Power BI Desktop for Power BI Report Server", "Embed a report using an iframe" (rs:embed=true), "Configure Windows authentication on the report server", and "Register a Service Principal Name (SPN) for a report server".

Hi Jessica_17​ 

Following up to confirm if the earlier responses addressed your query. If not, please share your questions and we’ll assist further.

Hi Jessica_17​ 

Have you had a chance to look through the responses shared earlier? If anything is still unclear, we’ll be happy to provide additional support.