topic Re: Trying to get roles needed for an RLS report using the APi in Developer

Trying to get roles needed for an RLS report using the APi

luish_castroc — Tue, 18 Mar 2025 19:55:36 GMT

Hi,

I currently have an AppService that uses a service principal, and I'm trying to embed reports in an Angular application using a combination of a Microsoft user and a service principal to generate the embedded tokens. Everything works except that when I try to load RLS reports, I need to provide the proper roles, and I don't have an easy way to get those roles either from the user or from the PowerBI API. I have Tenant.ReadAll access, so I think that prevents me from using the admin APIs. Any advice is appreciated.

Re: Trying to get roles needed for an RLS report using the APi

lbendlin — Tue, 18 Mar 2025 21:43:33 GMT

You can enumerate RLS roles in a semantic model via DMV queries.

select * from $SYSTEM.TMSCHEMA_ROLES

Re: Trying to get roles needed for an RLS report using the APi

luish_castroc — Tue, 18 Mar 2025 23:25:31 GMT

Thanks for the response, im not familiar with that process since i'm using the powerbi REST api

Re: Trying to get roles needed for an RLS report using the APi

lbendlin — Tue, 18 Mar 2025 23:50:27 GMT

You can run a DMV query through the REST API.

Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

Re: Trying to get roles needed for an RLS report using the APi

luish_castroc — Wed, 19 Mar 2025 13:28:25 GMT

thanks but as per the documentation on the api that won't work:

Service Principals aren't supported for datasets with RLS per RLS limitations or datasets with SSO enabled.

im using a service principal.

Re: Trying to get roles needed for an RLS report using the APi

v-nmadadi-msft — Tue, 13 May 2025 09:13:07 GMT

Hi @luish_castroc
If you have only a few RLS groups, a practical workaround is to create separate reports for each group and embed them individually, sharing each group's report accordingly, however, if there are many RLS groups, this approach becomes unmanageable and is not a suitable solution and if the feature is really important to you, Please raise a post in ideas forum
Fabric Ideas - Microsoft Fabric Community
to allow the use of service principal with RLS.

If you find this post helpful, please mark it as an "Accept as Solution" and consider giving a KUDOS. Feel free to reach out if you need further assistance.
Thank you

Re: Trying to get roles needed for an RLS report using the APi

v-nmadadi-msft — Sun, 18 May 2025 12:48:42 GMT

Hi @luish_castroc

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

Re: Trying to get roles needed for an RLS report using the APi

v-nmadadi-msft — Thu, 22 May 2025 17:00:31 GMT

Hi @luish_castroc

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If our responses has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

Re: Trying to get roles needed for an RLS report using the APi

v-nmadadi-msft — Wed, 28 May 2025 17:11:46 GMT

Hi @luish_castroc

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the community members for the issue worked. If our response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Thanks

Re: Trying to get roles needed for an RLS report using the APi

luish_castroc — Fri, 12 Sep 2025 14:41:12 GMT

Hi,

Sorry for the late response. What I ended up doing was a combination of steps: I used the workspace analysis with the dataset to get the full list of roles on the report and who’s assigned to them. Since I already had the user’s email and the AD groups, I just compared them and pulled out the matches.

https://learn.microsoft.com/en-us/rest/api/power-bi/admin/workspace-info-post-workspace-info
https://learn.microsoft.com/en-us/rest/api/power-bi/admin/workspace-info-get-scan-result