Forum Discussion
Error Exporting Power BI using Power Automate using RLS
Hi All,
I am trying to create Power BI Subscription logic (with filters and RLS) using Power Automate.
We have Premium Capacity also.
The requirement is to generate separate PDFs for each user based on their FILTERS (maintained in Sharepoint Online list) and RLS (which comes from AAS).
So, the flow loops through the Sharepoint List and generate PDFs and sent them to each user.
I am using "Export to File for Power BI Report" action
To test the flow, I used my credentials as one of the users, having filters and RLS assigned.
The flow runs successfully for me and sends email (since it is executed from my credentials and the Power BI connector is using my credentials).
But it fails for all the users from the Sharepoint list with very known error:
Creating embed token for accessing dataset requires effective identity username to be identical to the caller's principal name.
So, it means the following to me:
- I have to run flow from each user credentials - Not possible
- Tried Service Principal, but the Power BI connector in Power Automate does NOT have an option to login as Service Principal. (Microsoft has provided for CDS/Dataverse)
- Use Custom Connector, gets too complicated and does not work in the end
Please suggest and is there any example to build Power BI Subscription using Power Automate with different filters and RLS applied for each user.
Thanks in advance
Ritesh
15 Replies
If you have RLS in place then you can use your ONE report level filter to inject the user emai into the export request. That will then take care of the data visibility.
Be prepared for lots of agony though - exporting multiple reports will result in 429's very quickly. It's rather useless at the moment.
Hi Ibendlin
Thanks for your reply.
In my flow (which uses "Export to File for Power BI Report" action/API ), the Report Filters and RLS are applied correctly and generates PDFs but only for user who executes the flow. For rest of the user, it shows error message
Creating embed token for accessing dataset requires effective identity username to be identical to the caller's principal name.
However, I noticed yesterday that this happens only when source system is AAS otherwise it works fine other source systems.
Any suggestions? Should I use CUSTOMDATA?
Regards
Ritesh
That's not what I meant. Run the flow with high level permissions but inject the target user email into the RLS table via the report level filter.
Assuming you have a suitable RLS table in your data model (that controls the rest of the data model ) with the email as a primary key. You then set the report level filter to that table and that user email.
