Blank Page - Embedded Report

[Scheneyder]

I'm trying to embed a report in a SaaS platform, the report is conected to a semantic model and the model is build with Direct Query mode, however when I open the page I can only see a Blank Page with no errror or anything at all.

What could be causing this?

[v-echaithra]

Hi @Scheneyder ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-echaithra]

Hi @Scheneyder ,

We’d like to follow up regarding the recent concern. Kindly confirm whether the issue has been resolved, or if further assistance is still required. We are available to support you and are committed to helping you reach a resolution.

Best Regards,
Chaithra E.

[v-echaithra · Accepted solution]

Hi @Scheneyder ,

Thank you for the additional details.

In an App-Owns-Data scenario where the end users do not have Microsoft Entra ID (Azure AD) accounts, Power BI is unable to propagate a real user identity to Databricks. This is a current platform limitation.
Reference: Security in Power BI embedded analytics - Power BI | Microsoft Learn.

The document clearly states that when you supply an identity with an embed token, the RLS permissions of that identity will be applied to the data.

This means The identity passed in the embed token is evaluated by Power BI (semantic model) not automatically delegated to the underlying database. So in App-Owns-Data, RLS enforcement happens inside Power BI unless you explicitly configure token based SSO.

Features such as SSO, EffectiveIdentity with an identity blob, and OBO flow require an authenticated Entra ID user context.

In this model:

The embedded application queries Power BI using a service principal. Since the end user is not an Entra ID identity, Power BI has no user identity to forward to the DirectQuery source. As a result, Databricks RLS that depends on functions such as current_user() or email-based identity cannot resolve the user context and returns an empty result set. Power BI receives no rows and renders a blank report page without an error.

Recommended Approach for This Scenario

For embedded solutions without Entra ID users, we recommend enforcing security within the Power BI semantic model instead of relying on source-side RLS.

Hope this helps,
Thank you.

[v-echaithra]

Hi @Scheneyder ,

Thank you for reaching out to Microsoft Community.

Because the report is using DirectQuery and the RLS is implemented in Databricks instead of Power BI, the embedded scenario may not be forwarding the end-user’s identity to Databricks.
When the identity is not passed, Databricks evaluates the security rules with no user context and returns zero rows, which results in a blank report page rather than an error.

Recommended Steps to Resolve

Enable SSO on the Semantic Model

In Power BI Service, go to Semantic Model → Settings → Data source credentials.
Change authentication to OAuth2 (Organizational Account).
Enable Single Sign-On (SSO) so the user identity can flow to the data source.

Pass the User Identity in the Embed Token

When generating the embed token, include EffectiveIdentity.
Provide the logged-in user’s UPN along with the AAD access token (identity blob) so Power BI can delegate the identity downstream.

Use On-Behalf-Of (OBO) Authentication

The SaaS application must obtain an Azure AD token for the signed-in user, not rely solely on a Service Principal.
Implement the MSAL OBO flow to exchange the user token for a Power BI access token.

Confirm Databricks Is Configured for AAD Passthrough

Ensure the Databricks SQL Warehouse/cluster has Azure AD authentication enabled.
This allows Databricks to evaluate functions like current_user() using the propagated identity.

Test with a simple query or visual: SELECT current_user()

If configured correctly, it should return the actual end-user email, not a service principal.

Once identity propagation is working end-to-end, Databricks RLS will evaluate correctly and the embedded report should display data instead of a blank page.

Hope this helps.
Best Regards.

[Scheneyder]

I need a solution that works even when the user doesn't have an Azure account. 

Power BI "App Owns Data" (Embed for your Customers) allows ISVs and developers to embed reports in applications without requiring end-users to have Power BI licenses.

Take in consideration that the RLS is mapped in databricks trough a table that gets the user e-mail and filter the data.

[Scheneyder]

the RLS runs in databricks layer not in power bi