Forum Discussion

sanu's avatar
sanu
Regular Visitor
1 year ago
Solved

Embedding Power BI report with RLS enabled on Apps Own Data

Hi Community, I'm looking for some assistance with embedding a few of my Power BI reports. Let me provide some context: I have an Admin Report published to the Power BI Service. I've also created ...
Need Help
  • anilelmastasi's avatar
    anilelmastasi
    1 year ago
    RLS in a Power BI dataset requires a user identity, and in App Owns Data embedding with service principals, there’s no user context (no effective identity).
    Power BI doesn’t allow service principals to impersonate users for enforcing RLS — the embedded report fails silently or throws 403 Forbidden or embed token errors.
     
    For reference:
    Assigning users to roles within the Power BI service doesn't affect RLS or OLS when using an embed token (App owns data scenario only).
     
    To solve this problem:
    - Use “User Owns Data” instead of “App Owns Data”
    - If your users can log in with Microsoft 365 accounts, switch to User Owns Data embedding.
    - This passes the user identity, so RLS works as expected.
    - You can embed securely, and RLS filters apply.
     
    If this solved your issue, please mark it as the accepted solution. ✅
  • v-pnaroju-msft's avatar
    v-pnaroju-msft
    1 year ago

    Hi sanu,

    Thank you for your follow-up.

    As per my understanding, you are embedding a client report that connects via DirectQuery to a Power BI semantic model with Row-Level Security (RLS) enabled. Since you are using the App Owns Data model with a service principal, the embedding fails because EffectiveIdentity does not function when the dataset uses DirectQuery to another Power BI dataset. Consequently, RLS cannot be applied, and you may encounter errors such as 403 Forbidden, token generation failure, and schema load issues.

    Please find below some options that might help resolve the issue:

    1. If users can authenticate using Microsoft Entra ID (formerly Azure Active Directory), consider embedding via the User Owns Data model. RLS will function automatically, as the signed-in user's identity is passed through.

    2. If the App Owns Data model is mandatory, redesign the dataset to remove DirectQuery connections to another Power BI dataset. Instead, use Import mode or DirectQuery to a database, and then apply EffectiveIdentity in the embed token to enforce RLS securely.

    We hope this information proves helpful in resolving your issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

    Thank you.

v-pnaroju-msft's avatar
v-pnaroju-msft
Community Support
1 year ago

Hi sanu,

We just wanted to check if the information we gave helped fix your problem.
If you still need any help, please don’t hesitate to reach out to the Microsoft Fabric community.

Thank you.