Forum Discussion
Generate Tokek Embedded - Error: proxy model should include the core model ID
Hi marcio_fornari,
Thanks for the update, glad to hear you figured it out!
Yes, this behavior makes sense. When generating the embed token using a master user, there can be permission issues, especially with composite models and RLS across different workspaces. That’s why using a service principal (which is the recommended approach for embedding) worked for you.
Regarding your question : yes, you can skip RLS when using a service principal. To do that, simply don’t include the "identities" section in your GenerateToken request. If you don't pass any identities, Power BI won't apply RLS, and the service principal will see all the data in the report.
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Regards,
B Manikanteswara Reddy
Hi marcio_fornari ,
Glad to hear the report opens now.
The new error you're seeing, "Error fetching data for this visual," usually happens because the visuals are trying to connect directly to the core datasets and the embed token does not properly authorize access to them.
In your case (composite model + multiple datasets + RLS), you must:
Ensure that when generating the embed token:
- ALL datasets involved are listed under the "datasets" array (you already have this).
- Each dataset with RLS has an associated identity in the "identities" section (you are doing this correctly too).
Also add these two properties for the datasets used by the report (especially the proxy dataset ,the one that links to others):
{
"id": "f213a5d2-d028-424b-b9d4-daae68d740ea", // your proxy dataset
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": true,
"isEffectiveIdentityRolesRequired": true
}
These flags must be present on the proxy dataset entry (your main report's dataset) to correctly pass through user identity to underlying datasets.
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! |
Regards,
B Manikanteswara Reddy
Hi, doesn't work 😞
My post has a image with 4 datasets.
1 - dataset of report
2 - Dataset 1 and Dataset 2 with RLS
3 - dataset no rls
Download of the 4 pbix: https://easyupload.io/m/ew5xx7
POST /v1.0/myorg/GenerateToken HTTP/1.1
Host: api.powerbi.com
Authorization: Bearer xxxxx
Content-Type: application/json
BODY:
{
"datasets": [
{
"id": "f213a5d2-d028-424b-b9d4-daae68d740ea",
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": false, //dataset of report
"isEffectiveIdentityRolesRequired": false //dataset of report
},
{
"id": "23a0db58-fa8f-4fd5-8fae-51479d0c021a",
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": false, //because this dataset not have rls (dataset no rls)
"isEffectiveIdentityRolesRequired": false //because this dataset not have rls (dataset no rls)
},
{
"id": "42da3437-daf5-4f0b-b9db-dc8a6d7211f0",
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": true, //this dataset has rls (dataset 1)
"isEffectiveIdentityRolesRequired": true //this dataset has rls (dataset 1)
},
{
"id": "0d100a5b-d61a-414c-ac7e-53a5d9ae75da",
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": true, //this dataset has rls (dataset 2)
"isEffectiveIdentityRolesRequired": true //this dataset has rls (dataset 2)
}
],
"reports": [
{
"id": "fc4f1364-f740-4ddb-851c-9a17337ccd11"
}
],
"identities": [
{
"username": "Roma",
"roles": [
"regra1"
],
"datasets": [
"42da3437-daf5-4f0b-b9db-dc8a6d7211f0" //(dataset 1)
]
},
{
"username": "Roma",
"roles": [
"regra1"
],
"datasets": [
"0d100a5b-d61a-414c-ac7e-53a5d9ae75da" // dataset 2
]
}
]
}
Hi marcio_fornari ,
Thanks for the detailed info and for sharing your setup!
Based on your current request and the behaviour you're seeing ("Error fetching data for this visual"), here are some key things to check and adjust:
- isEffectiveIdentityRequired / isEffectiveIdentityRolesRequired on Proxy Dataset Even if the proxy dataset (your report's dataset) doesn’t have RLS itself, these two flags must be set to true because it's proxying identity to downstream datasets that do have RLS.
So this is the correction you need to make:
{
"id": "f213a5d2-d028-424b-b9d4-daae68d740ea", // Proxy dataset
"xmlaPermissions": "ReadOnly",
"isEffectiveIdentityRequired": true,
"isEffectiveIdentityRolesRequired": true
}- identities section must include ALL datasets requiring RLS
You're currently passing separate identities for each RLS dataset , that’s okay(both can work). But you can also combine them into a single entry like this:
{
"username": "Roma",
"roles": ["regra1"],
"datasets": [
"42da3437-daf5-4f0b-b9db-dc8a6d7211f0",
"0d100a5b-d61a-414c-ac7e-53a5d9ae75da"
]
}This ensures consistency and is easier to manage.
- Proxy dataset should always pass identity even if it doesn’t use it directly
That's the core reason for the "Error fetching data for this visual" in composite models with RLS
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Regards,
B Manikanteswara Reddy
Hi, i found my error. I was generating the token with "master user". Generate token with "service principal" works. I don't understand why generate token with master user doesn't work, and a question. Can i ignore the RLS with "service principal" and open the report without the filter ?
Hi marcio_fornari,
Thanks for the update, glad to hear you figured it out!
Yes, this behavior makes sense. When generating the embed token using a master user, there can be permission issues, especially with composite models and RLS across different workspaces. That’s why using a service principal (which is the recommended approach for embedding) worked for you.
Regarding your question : yes, you can skip RLS when using a service principal. To do that, simply don’t include the "identities" section in your GenerateToken request. If you don't pass any identities, Power BI won't apply RLS, and the service principal will see all the data in the report.
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Regards,
B Manikanteswara Reddy