Embedding Power BI Report with RLS on SharePoint Intranet - Access Control Issues

[ahmedbabiker59]

Hi,

I'm trying to embed a Power BI report (KPI dashboard) into our company's SharePoint intranet for all employees to view. The report uses a live connection to a semantic model with the implemented Row-Level Security (RLS). However, not all employees can access the underlying data due to the RLS configuration and workspace permissions.

I aim to allow all SharePoint users who can access the embedded report to see the KPIs, regardless of their data access rights in the Power BI workspace. How can I achieve this?

I'm looking for solutions that address the RLS and workspace access limitations to ensure broad visibility of this crucial KPI data within the intranet.

Any advice or suggestions would be greatly appreciated.

[v-dineshya]

Hi @ahmedbabiker59 ,

Thanks for reaching out to the Microsoft fabric community forum. 

Option 1: Create a Public/General View Without RLS:

Displaying aggregate or non-sensitive KPI data to all users

Please follow steps:
Duplicate the report or create a separate report from the same dataset. Remove RLS from this specific version of the dataset/report. Publish this "public view" report to a dedicated workspace. Share this version via the Power BI web part in SharePoint Online, using "Share with everyone in your organization." This way, RLS won't restrict access, and everyone on the intranet can view the same KPI summary.

Option 2: Use Power BI Embedded with Service Principal / Embed Token:
Full control over who sees what in embedded reports

Use Power BI Embedded and embed the report using an "App Owns Data" model with a service principal or master account. In this case, RLS is applied based on the identity you pass into the embed token, not the actual user viewing the report.

You host the Power BI report using an Azure-based web app or proxy page. Your backend controls the embed token generation.
You can generate a token for a specific RLS role or even a general viewer role that sees all data.

Note: This approach is more complex and usually used in customer-facing apps, but it gives you full control over access.

Option 3: Use a Viewer Role Without RLS (Hybrid Approach):
Mixed access – some users with detailed views, others with a summarized view

Maintain RLS roles for sensitive users. Create an RLS role with no filters (full data view) and assign it to general viewers. Assign this role to a security group (Azure AD group) that includes all intranet users. In SharePoint, ensure this group has access to the report.

Note: For simplicity and broad internal access: Create a KPI-only version of your report without RLS, publish it to a workspace, and embed it into SharePoint via the Power BI web part.
If you need finer control or mixed access: Use an RLS "Viewer" role with no restrictions assigned to a group that includes all SharePoint users.

If you find this post helpful, please mark it as an "Accept as Solution" and consider giving a KUDOS. Feel free to reach out if you need further assistance.
Thanks and Regards

[v-dineshya]

Hi @ahmedbabiker59 ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[v-dineshya]

Hi @ahmedbabiker59 ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[v-dineshya]

Hi @ahmedbabiker59 ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
If our response addressed, please mark it as Accept as solution and consider giving a KUDOS. Feel free to reach out if you need further assistance.

Regards,

Dinesh

[Akash_Varuna]

Hi @ahmedbabiker59 You can try these for you case 

• Creating a KPI-specific dataset : Build a dataset that removes RLS and focuses solely on KPIs to allow universal access.

• Embedding with "Embed for Organization" mode : Use Power BI’s SharePoint Online Embed option while ensuring Viewer role access for all users.

• Leveraging a service principal : Configure a service principal in Azure AD to enforce a generic RLS role for consistent KPI access.

• Duplicating the report with relaxed RLS : Create a copy of the report with simplified or no RLS restrictions for embedding purposes.

• Using a custom app : Develop a custom app leveraging Power BI Embedded APIs to embed the report with tailored access logic.
  If this post helped please do give a kudos and accept this as a solution
  Thanks In Advance