How to implement RLS using AAD/AD in Embedded reports

[SNPPowerbi]

Hi,

Have generated powerbi report, want to integrate with custom application. Where i want to implement Row Level security in my embedded report using AAD.

Do not want to use database authentication mode

Please suggest me the solution for the same.

[v-huizhn-msft · Accepted solution]

Hi @SNPPowerbi,

Power BI Embedded doesn't depend on the Azure AD account or windows account. You can use your favorite authentication (forms auth, basic auth, etc) in your app, and you can combine these account with Power BI RLS. 

First, you must understand how the Power BI Embedded works and how the access token (which is used for embedding reports) is used.

After your app authenticate the user, your app should determine what role is needed, and use the following json/PHP/.Net(it depends on your custom app) string as the input of access token signature. For example, add the RSL(highlighted in bold) in json string:

{
  "wid":"{workspace id}",
  "rid":"{report id}",
  "wcn":"{workspace collection name}",
  "iss":"PowerBISDK",
  "ver":"0.2.0",
  "aud":"https://analysis.windows.net/powerbi/api",
  "nbf":{start time of token expiration},
  "exp":{end time of token expiration},
  "roles":"{role names (multiple) delimited by comma}",
  "username":"{user name}"
}

For more details, you can review the following articles.

Works with Row Level Security in Power BI and Power BI Embedded
How to use Power BI Embedded via REST
Row level security with Power BI Embedded

Best Regards,
Angelia