DirectLake over OneLake dataset with RLS or SSO Enabled?

Hi jaryszek,

Thank you for the followup.

Based on my understanding, Power BI enforces a strict separation between application identity or Service Principal and user identity or delegated authentication. Features that require evaluation of an actual user (for example, RLS or data source SSO) cannot be used with app-only execution.

Please consider the following approach, which may help resolve the issue:

1. Using a Service Principal for Power BI embedding in a JavaScript application is supported when application level security is acceptable and per-user data filtering is not required. In this model, all users access the report under the same application identity. Power BI does not evaluate individual end user identities within the dataset. If your requirement is per-user data security, the appropriate approach is RLS with delegated user authentication. This cannot be combined with Service Principal only query execution.

2. If the semantic model is Direct Lake over OneLake, no RLS roles are defined, and the tenant setting “Allow service principals to use Power BI APIs” is enabled, then Service Principal and the ExecuteQueries REST API are supported and function as designed. Direct Lake does not use data source SSO, so SSO is not applicable in this scenario.

For further reference, please consult the following links:
Embed content in your Power BI embedded analytics application - Power BI | Microsoft Learn
Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

We hope the information helps to resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.