Embedding Power BI report with RLS on third party portal

[msdf]

Hi 

Hope someone can shed some light on this or point me in the right direction. 

We have a vendor that's building a portal for us for our clients to access various documents, locations, transactions etc. We'd also like to place some of our client reports on this portal to make it a one stop shop for them. 

Can this be done efficiently and securely? I assume we'd need to enable exteral user sharing. We also don't want to expose one client's data to another. Just being a little padantic as reports will be sitting on a thirdparty portal for access. 

Any info on this would be much appreciated. 

Thank you

[Anonymous · Accepted solution]

Hi, @msdf 

Thanks for the reply from @AmiraBedh , please allow me to provide addition:

To efficiently and securely embed Power BI reports in third-party portals, especially when you need to ensure that each client only sees their data, you can take advantage of Power BI Embedded in Azure. This service allows you to embed interactive Power BI reports and dashboards into applications, websites, portals, and more, ensuring a seamless and secure experience for users across devices. You can check the following link:

Azure and Power BI - Power BI | Microsoft Learn

To ensure that one client can't access the other's data, you can implement row-level security (RLS) in Power BI reports. RLS allows you to control access to data at the row level based on user roles or login credentials. When used in conjunction with Power BI Embedded, RLS ensures that each client sees only the data that's relevant to them, even when accessing reports through third-party portals. For more information about implementing RLS in Power BI, you can see:

Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

Regarding external user sharing, Power BI integrates with Microsoft Entra business-to-business (B2B) to securely distribute content to guest users outside your organization while maintaining control and administrative access to internal data. With this integration, you can invite external users to securely view Power BI content. You can see the following link:

Distribute Power BI content to external guest users using Microsoft Entra B2B - Power BI | Microsoft...

How to Get Your Question Answered Quickly 

Best Regards

Yongkang Hua

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[AmiraBedh]

You need to configure RLS to restrict data access for given users, which helps in showing only the relevant data to each client.

In the other hand, you will have to enable external sharing to allow clients to access the reports through the third-party portal. (in the Power BI service)

After, you can create an AAD tenant and a Power BI Embedded resource in Azure, register your application in the AAD and gnerate the embed token that includes RLS information.

Don't forget the embed tokens which are required for securing the reports and ensuring that the RLS rules are applied correctly. The tokens need to be generated server-side.