Forum Discussion
Issue with Accessing Power BI Admin APIs Using Service Principal (401 Error tryout mode)
Hi Venkatesh_ ,
This behaviour is actually expected in App Owns Data scenario. In this model, Power BI only sees the application or service principal, not your actual end users. Because of that, in Activity Logs you will see GUIDs instead of user email IDs, and there is no setting in Power BI to change this.To track real user activity, you need to handle it from your application side. Since your app already knows which user is logged in, you can use that information while generating the embed token. For example, when your backend calls the Generate Embed Token API, you can store details like user email, report ID, workspace ID, and timestamp in your database.
After that, on the frontend, you can use Power BI JavaScript SDK events (like report loaded, page changed, etc.) to capture how the user is using the report. These events can be sent back to your backend and stored along with the same user details. This way you can build your own complete usage tracking and audit report.
Also, even if you are using Effective Identity for RLS, that information is used only internally by Power BI for data filtering and will not come in Activity Logs as user email.
So overall, Activity Log is mainly for service-level auditing, not for detailed end-user tracking in embedded scenarios. For your requirement, maintaining logs in your application is the recommended approach.
Docs Reference
You can refer to below official Microsoft documentation:
Embed content in your Power BI embedded analytics application - Power BI | Microsoft Learn
Audit and usage admin settings - Microsoft Fabric | Microsoft Learn
Power BI embedded analytics Client APIs | Microsoft Learn
Thank you.
Hi Venkatesh_ ,
Yep, this is expected behavior in an App Owns Data scenario. Since the app or service principal is the identity talking to Power BI, the audit and activity logs usually show object IDs or GUID-based identifiers instead of the actual email addresses of the end users viewing the embedded reports.
There isn’t a setting that will automatically replace those GUIDs with your application users in the Power BI Activity Log. Even when end users are authenticated through your app, Power BI audit logs aren’t meant to give full end-user attribution for embedded usage. So the GUIDs you see in events like GenerateToken and ViewReport usually can’t be used on their own to identify the actual client who viewed the report.
If you need client-level usage tracking, the usual approach is to keep that correlation in the application layer. Since your app knows which user is authenticated when an embed token is generated, you can log that user information alongside report access events and use it to build a complete audit trail of report consumption.
If you’re using effective identities for row level security, those identities help determine what data a user can access, but they aren’t automatically surfaced as user email addresses in the Power BI Activity Log. Based on your description, this seems like expected platform behavior rather than a missing setting or configuration issue.
Thank you.
Hi Venkatesh_ ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.
Thank you.
v-tejrama
Sorry, How do I get this working? Could you please help me with the steps to follow? - Since your app knows which user is authenticated when an embed token is generated, you can log that user information alongside report access events and use it to build a complete audit trail of report consumption.Hi Venkatesh_ ,
This behaviour is actually expected in App Owns Data scenario. In this model, Power BI only sees the application or service principal, not your actual end users. Because of that, in Activity Logs you will see GUIDs instead of user email IDs, and there is no setting in Power BI to change this.To track real user activity, you need to handle it from your application side. Since your app already knows which user is logged in, you can use that information while generating the embed token. For example, when your backend calls the Generate Embed Token API, you can store details like user email, report ID, workspace ID, and timestamp in your database.
After that, on the frontend, you can use Power BI JavaScript SDK events (like report loaded, page changed, etc.) to capture how the user is using the report. These events can be sent back to your backend and stored along with the same user details. This way you can build your own complete usage tracking and audit report.
Also, even if you are using Effective Identity for RLS, that information is used only internally by Power BI for data filtering and will not come in Activity Logs as user email.
So overall, Activity Log is mainly for service-level auditing, not for detailed end-user tracking in embedded scenarios. For your requirement, maintaining logs in your application is the recommended approach.
Docs Reference
You can refer to below official Microsoft documentation:
Embed content in your Power BI embedded analytics application - Power BI | Microsoft Learn
Audit and usage admin settings - Microsoft Fabric | Microsoft Learn
Power BI embedded analytics Client APIs | Microsoft Learn
Thank you.Hi Venkatesh_ ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions
Thank you.
