topic Re: RLS with Power BI Embedded Premium Question? in Developer

RLS with Power BI Embedded Premium Question?

rasta123 — Fri, 07 Jul 2017 21:06:48 GMT

We are working with Power BI Premium Embedded and want to implement RLS based on Roles, this was available in previous Power BI Embeded service on Azure following the below documentation:

https://docs.microsoft.com/en-us/azure/power-bi-embedded/power-bi-embedded-rls

in the example from the above link we could use this passing the Role with method below:

var embedToken = PowerBIToken.CreateReportEmbedToken(this.workspaceCollection, this.workspaceId, report.Id, "Andrew Ma", ["Manager"]);'

This does not appear to be available yet and based on what we read it appears it is due this quarter or possibly in a July update. Can anyone confirm when this will be available via preview or in production?

Re: RLS with Power BI Embedded Premium Question?

yuryb — Mon, 10 Jul 2017 15:09:44 GMT

Yes, currently this is not supported but we're working to enable RLS for the new embedding API. First this will be supported for reports based on Power BI models (not AS on-prem or AS Azure live connections). The RLS roles and username will be passed as additional parameters to GenerateToken API. The current plan is to make this available in August.

Best regards

Re: RLS with Power BI Embedded Premium Question?

Eric_Zhang — Tue, 11 Jul 2017 01:45:16 GMT

@yuryb wrote:

Yes, currently this is not supported but we're working to enable RLS for the new embedding API. First this will be supported for reports based on Power BI models (not AS on-prem or AS Azure live connections). The RLS roles and username will be passed as additional parameters to GenerateToken API. The current plan is to make this available in August.

Best regards

@yuryb

Thanks for the confirmation. By the way, are you from the product team?

Re: RLS with Power BI Embedded Premium Question?

yuryb — Tue, 11 Jul 2017 06:37:48 GMT

Yes. Looking how to reflect this in my signature

Re: RLS with Power BI Embedded Premium Question?

fbeekvel — Wed, 26 Jul 2017 11:23:33 GMT

Hi @yuryb

Do you have any idea (rough ballpark) when RLS will be available for live Azure AS connections?

Re: RLS with Power BI Embedded Premium Question?

avive — Sun, 30 Jul 2017 05:45:39 GMT

Hi,

We do not have a date to share yet for PBI Embedded with RLS connecting to AS Azure

Re: RLS with Power BI Embedded Premium Question?

rasta123 — Sun, 30 Jul 2017 12:42:12 GMT

Aviv, thanks for update.

We have re-developed a new multi-tenant PaaS application on Azure & Azure SQL and the last enhancement we want to make is the embedding of Power BI & Report Visuals. We have everything hooked up with the new API's and everything seemed to work great. We have temporarily hard-coded some TenantID column filters into our models, but the last piece of the puzzle was to implement tenant security within our Power BI Models so we don't have to build seperate models for each Tenant. We are planning on utilizing role based security within our models and passing the tenant ID within the API in order to filter using these roles the data based on that TenantID column. Can we assume this is the best approach and anticipate the Microsoft is going to support this approach fairly soon within Power BI Models and the new API's? This would allow us to setup a single user account in Azure AD to support each Tenant and connect to his role. Does that make sense, I am not the developer, but working with him to map out final pieces of the puzzle.

Re: RLS with Power BI Embedded Premium Question?

berhir — Wed, 09 Aug 2017 12:37:38 GMT

Hi @yuryb and @avive,

I am currently working on a very similar scenario as rasta123.

We have a multi-tenant web app and want to provide a single report that shows only the data for the current tenant.

The data is stored in a Sql Azure DB and we use direct query to get the data into the report.

We have already embedded the report and everything works fine so far.

The only missing piece to make it available to our customers is RLS.

@yuryb said there will be an update in August that brings RLS to the new API. Is my scenario possible with this update? And do you already have a date?

Thanks!

Re: RLS with Power BI Embedded Premium Question?

avive — Sun, 13 Aug 2017 06:33:43 GMT

RLS is out, read about it here: https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/

and also about the updates to the GenerateToken API that goes with it: https://msdn.microsoft.com/en-us/library/mt784614.aspx

Re: RLS with Power BI Embedded Premium Question?

nicksav — Thu, 07 Sep 2017 03:44:39 GMT

Hi Avive

Still can't find info on how to generate an embeeded token with Roles for Tiles and Dashboards?

Is there any time line to support this?

Thanks

Nick

Re: RLS with Power BI Embedded Premium Question?

avive — Thu, 07 Sep 2017 10:19:44 GMT

Yes you are right, RLS for tiles and dashboards is not yet available, it is being worked at as we speak... you will see an update when we are ready to go

Re: RLS with Power BI Embedded Premium Question?

Anonymous — Tue, 12 Sep 2017 12:19:57 GMT

Hi,

Do you have any idea when RLS will be available for live on premise SSAS connections?

We have a proof of concept (app owns data) that depends on this, and are stuck at the moment.

Kind regards,

Re: RLS with Power BI Embedded Premium Question?

rasta123 — Tue, 12 Sep 2017 12:35:01 GMT

We have succesfully got this working with Azure SQL with an embedded project and have purchased an Premium EM1 SKU to get started. My next questions is how does the sku get associated with our account and how would we monitor usage on the account just like any other Azure usage? I assume the SKU is connected to our Office 365 domain and somehow uses that, but not sure how to validate and monitor embedded usage.

Re: RLS with Power BI Embedded Premium Question?

nimrod — Mon, 18 Sep 2017 09:01:07 GMT

We have support for Analysis Services live connections now. See more here- https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/#working-with-analysis-services-live-connections

Re: RLS with Power BI Embedded Premium Question?

nimrod — Mon, 18 Sep 2017 09:03:26 GMT

After purchasing a SKU, you need to assign the relevant workspace to the capacity you purchased.

It can be done through the Admin Portal in the PBI Portal.

Re: RLS with Power BI Embedded Premium Question?

Anonymous — Tue, 19 Sep 2017 15:08:41 GMT

Hi nimrod,

We're currently trying to implement RLS with Embedded and SSAS but encountered the issue stated above.

While your post gave me hope to be able to go forward, the documentation says the following about the effective identity passed to the GenerateTokenRequest method:

From https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls: "The effective identity that is provided for the username property must be a windows user with permissions on the Analysis Services server."

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "username", roles: new List<string> { "roleA", "roleB" }, datasets: new List<string> { "datasetId" }) });

So the "username" value should match a Windows user with access on SSAS ?

This would lead me to believe that the "app own data" scenario isn't supported with Embedded and SSAS using RLS.

Is it a correct assumption ? If so, is it only temporary ?

Not having this feature will unfortunately bring our Embedded development to a full halt.

Kind regards,

Re: RLS with Power BI Embedded Premium Question?

mido — Sat, 23 Sep 2017 19:03:38 GMT

Hey

For non windows users go with the CUSTOMDATA function. If I understand you correctly this is exactly what you're after?

Check Kaspers post here -

https://www.kasperonbi.com/using-customdata-and-ssas-with-power-bi-embedded/

Hth

Re: RLS with Power BI Embedded Premium Question?

Geronimo — Tue, 26 Sep 2017 13:22:18 GMT

Hello,

Will RLS for Dashboard and Tiles appear at the same time, or will Tiles be first supported for RLS ? Any prespective (short, mid, long term) would be greatly appreciated.

Re: RLS with Power BI Embedded Premium Question?

Anonymous — Tue, 26 Sep 2017 13:38:49 GMT

Hi,

I wasn't aware of the CUSTOMDATA function, which seems to be very interesting for non Windows users indeed.

Altough it didn't help with the RLS implementation we chosed up until now : passing a filter key as the user identity and a filter id as role, and managing the roles at report level.

We now make the distinction between reports using SSAS and other ones and adapt ou RLS accordingly.

The specific issue faced regarding the RLS and SSAS was solved by multiplying SSAS roles 🙂

Kind regards,

Re: RLS with Power BI Embedded Premium Question?

yuryb — Wed, 27 Sep 2017 07:14:49 GMT

Hello,

We expect RLS for both tile and dashboard to be available in Q4.

Best regards