Embedding Power BI report with RLS enabled on Apps Own Data

[sanu]

Hi Community,

I'm looking for some assistance with embedding a few of my Power BI reports. Let me provide some context:

I have an Admin Report published to the Power BI Service.
I've also created a Client Report, which is a replica of the Admin Report but connects to the Admin report’s semantic model. I’ve configured Row-Level Security (RLS) in the Admin Report using the User table, with a rule: Email = Username()

and that will be used in the client report.

So my Admin report works without RLS and Client report will filters based on user logged into the client application.

Now, I want to embed these reports into a client-facing application using the App Owns Data model. To support this, I’ve added a service principal as an admin in the Power BI workspace.

However, while trying to embed the Client Report, I’m encountering issues such as:

• 403 Forbidden errors
• Schema errors
• In some cases, the embed token fails to generateEven i tried to embed the Admin report which is directly connected to the source however it also fails to embed or load.

  Interestingly, other reports from the same workspace are embedding successfully. This makes me wonder — could the issues be related to:

  • The report using DirectQuery to a Power BI semantic model?
  • The presence of RLS?

    For reference, my backend is built in PHP and the frontend is Angular.

    If anyone has experienced something similar or has insights to share, I’d greatly appreciate the help!

    Thank you!
    
    @amitchandak 

[anilelmastasi · Accepted solution]

RLS in a Power BI dataset requires a user identity, and in App Owns Data embedding with service principals, there’s no user context (no effective identity).

Power BI doesn’t allow service principals to impersonate users for enforcing RLS — the embedded report fails silently or throws 403 Forbidden or embed token errors.

For reference:

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security

Assigning users to roles within the Power BI service doesn't affect RLS or OLS when using an embed token (App owns data scenario only).

To solve this problem:

- Use “User Owns Data” instead of “App Owns Data”
- If your users can log in with Microsoft 365 accounts, switch to User Owns Data embedding.
- This passes the user identity, so RLS works as expected.
- You can embed securely, and RLS filters apply.

If this solved your issue, please mark it as the accepted solution. ✅

[sanu]

Thank you all for the support.

[v-pnaroju-msft]

Hi sanu,

We just wanted to check if the information we gave helped fix your problem.
If you still need any help, please don’t hesitate to reach out to the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi sanu,

We would like to follow up and see whether the details we shared have resolved your problem.
If you need any more assistance, please feel free to connect with the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft · Accepted solution]

Hi sanu,

Thank you for your follow-up.

As per my understanding, you are embedding a client report that connects via DirectQuery to a Power BI semantic model with Row-Level Security (RLS) enabled. Since you are using the App Owns Data model with a service principal, the embedding fails because EffectiveIdentity does not function when the dataset uses DirectQuery to another Power BI dataset. Consequently, RLS cannot be applied, and you may encounter errors such as 403 Forbidden, token generation failure, and schema load issues.

Please find below some options that might help resolve the issue:

1. If users can authenticate using Microsoft Entra ID (formerly Azure Active Directory), consider embedding via the User Owns Data model. RLS will function automatically, as the signed-in user's identity is passed through.

2. If the App Owns Data model is mandatory, redesign the dataset to remove DirectQuery connections to another Power BI dataset. Instead, use Import mode or DirectQuery to a database, and then apply EffectiveIdentity in the embed token to enforce RLS securely.

We hope this information proves helpful in resolving your issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

[sanu]

Thank you for the solution provided and are there anything we can do in the backend side to get the user identity and enforce RLS on the dataset? Any working solultion. Thank you

[v-pnaroju-msft]

Thankyou @anilelmastasi for your response.

Hi sanu,

We appreciate your inquiry through the Microsoft Fabric Community Forum.

We would like to inquire whether have you got the chance to check the solution provided by @anilelmastasi to resolve the issue. We hope the information provided helps to clear the query.
Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Thank you.

[anilelmastasi · Accepted solution]

RLS in a Power BI dataset requires a user identity, and in App Owns Data embedding with service principals, there’s no user context (no effective identity).

Power BI doesn’t allow service principals to impersonate users for enforcing RLS — the embedded report fails silently or throws 403 Forbidden or embed token errors.

For reference:

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embedded-row-level-security

Assigning users to roles within the Power BI service doesn't affect RLS or OLS when using an embed token (App owns data scenario only).

To solve this problem:

- Use “User Owns Data” instead of “App Owns Data”
- If your users can log in with Microsoft 365 accounts, switch to User Owns Data embedding.
- This passes the user identity, so RLS works as expected.
- You can embed securely, and RLS filters apply.

If this solved your issue, please mark it as the accepted solution. ✅