Power BI Embedded visual fails with HTTP 403 when using custom DAX measures

[mpatino123]

🔧 Issue: Power BI Embedded visual fails with HTTP 403 when using custom DAX measures
Hello community,

We're experiencing an issue with Power BI Embedded in our production portal (App owns data model). Some visuals fail to load and return the following error:

"We couldn’t retrieve the data for this visual. Please try again later."
HTTP status code: 403 (Forbidden)
Cluster URI: https://wabi-paas-1-scus-api.analysis.windows.net/
Client version: 2503.5.23735-train
Dataset and report reside in the same workspace. RLS is active.

💡 Context:
The same report works perfectly when opened in Power BI Desktop and Power BI Service.

The problem only appears in visuals that include new custom DAX calculations (KPIs, line charts with evolution, etc.).

Simpler visuals and tables render correctly.

We're embedding the report in a secure internal portal using Azure AD + Embed token.

We use GenerateTokenRequest with effective identity and RLS roles.

🔍 What we suspect:
The error may be due to RLS restrictions or invisible columns being referenced in DAX.

Or the Embed token identity lacks visibility to fields used in the custom measures.

✅ What we've tried:
Simulating roles via “View as Role” in Power BI Desktop → Works.

Testing embed tokens without identities → Visuals load but bypass RLS (not an option in production).

Simplifying measures and checking ISINSCOPE/SELECTEDVALUE logic.

📌 Questions:
Are there known limitations when embedding reports with DAX measures referencing hidden relationships or filtered tables?

Could Power BI Service silently block a visual due to a failed calculation behind RLS?

Is there a recommended way to validate or debug measure evaluation under embed tokens?

Any suggestions or diagnostic methods are appreciated. Thanks in advance!

[V-yubandi-msft]

Hi @mpatino123 ,

We noticed we haven't received a response from you yet, so we wanted to follow up and ensure the solution we provided addressed your issue. If you require any further assistance or have additional questions, please let us know.

Your feedback is valuable to us, and we look forward to hearing from you soon.

[V-yubandi-msft]

Hi @mpatino123 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[V-yubandi-msft]

Hi @mpatino123 ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution we provided for your issue worked for you  or let us know if you need any further assistance?

Your feedback is important to us, Looking forward to your response. 

[V-yubandi-msft · Accepted solution]

Hi @mpatino123 ,

Even if a table is hidden or not directly visible in a report, Power BI still requires it to be listed in the effectiveIdentity. tables array if a DAX measure refers to it, whether directly, through a relationship, or via another measure. If it’s missing, your visual will show a 403 error.

1. Use tools like DAX Studio or Tabular Editor to check which tables your measures depend on.

2. Ensure the embed token includes every referenced table, even hidden ones or those in filtered relationships.

3. It's not about what's visible on screen it’s about whether the token recognizes the table.

Key points to remember.

1. Hidden tables or columns must be included in the embed token if your DAX measures use them.

2. If a required table is missing from the embed token, Power BI won’t explain the error properly. it will just throw a generic 403 error, which usually means data access was denied, not a calculation mistake.

Thank you for your response @tharunkumarRTK .

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.

[tharunkumarRTK]

@mpatino123 

Referencing invisible columns in dax might not be the problem in this case.

Have you added all the end users to the security role? If yes, for the user who were facing this issue, ask them to open the report URL, if they were able to reder the report properly in power bi service then this is not an issue with RLS but issue is with the way of embedding. If not then its an issue with RLS. 

Using test as role in desktop wont give you clarity on where the issue is

Need a Power BI Consultation? Hire me on Upwork

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!