Generate Tokek Embedded - Error: proxy model should include the core model ID

[marcio_fornari]

i have a report conected with 3 datasets. Two has RLS.  The datasets ares in different workspaces.

To generate the token, my request contain all the datasets, body request:

Post: https://api.powerbi.com/v1.0/myorg/GenerateToken

  "datasets" => 
    [
      //dataset of report
      "id" => "f213a5d2-d028-424b-b9d4-daae68d740ea"
      "xmlaPermissions" => "ReadOnly"
    ]
    [
      //dataset1
      "id" => "42da3437-daf5-4f0b-b9db-dc8a6d7211f0"
      "xmlaPermissions" => "ReadOnly"
    ]
    [
      //dataset2
      "id" => "0d100a5b-d61a-414c-ac7e-53a5d9ae75da"
      "xmlaPermissions" => "ReadOnly"
    ]
  ]
  "reports" => [
      "id" => "fc4f1364-f740-4ddb-851c-9a17337ccd11"
  ]
  "identities" => 
    [
      "username" => "Roma"
      "roles" => [
       "regra1"
      ]
      "datasets" => [
        "42da3437-daf5-4f0b-b9db-dc8a6d7211f0"
      ]
    ]
    [
      "username" => "Roma"
      "roles" =>[
        "regra1"
      ]
      "datasets" => [
        "0d100a5b-d61a-414c-ac7e-53a5d9ae75da"
      ]
    ]
  ]

i got this error:

Generate token request for proxy model should include the core model ID

my report lineage:

[v-bmanikante]

Hi @marcio_fornari ,

Thank you for reaching out to Microsoft Fabric Community.

It looks like the issue you're facing is very similar to one that another user encountered earlier. That issue has been resolved, and the solution might be helpful in your case as well.

Please refer to the post linked below for the full explanation and steps:
Solved: Re: Error: Generate token request for proxy model ... - Microsoft Fabric Community

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,
B Manikanteswara Reddy

[marcio_fornari]

Hi, not working for me.. I tried it, receiving same error, see my post. 

[v-bmanikante]

Hello @marcio_fornari ,

You're getting the error "Generate token request for proxy model should include the core model ID" because your report is based on a semantic model (proxy dataset) that connects to other datasets with RLS, possibly from different workspaces. This setup is known as a composite model or DirectQuery for Power BI datasets.

To fix this when generating the embed token:

1. Make sure you include all related dataset IDs in your request — both the report's own dataset (proxy model) and the connected core datasets.
2. Most importantly, you need to add these two properties to the proxy model dataset in your request:
• "isEffectiveIdentityRequired": true
• "isEffectiveIdentityRolesRequired": true

You can refer the below document as reference.

Embed Token - Reports GenerateTokenInGroup - REST API (Power BI Power BI REST APIs) | Microsoft Lear...

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[marcio_fornari]

Hi, now the report is open, but i got this error on my visuals

[v-bmanikante]

Hi @marcio_fornari ,

Glad to hear the report opens now.

The new error you're seeing, "Error fetching data for this visual," usually happens because the visuals are trying to connect directly to the core datasets and the embed token does not properly authorize access to them.

In your case (composite model + multiple datasets + RLS), you must:

Ensure that when generating the embed token:

• ALL datasets involved are listed under the "datasets" array (you already have this).
• Each dataset with RLS has an associated identity in the "identities" section (you are doing this correctly too).

Also add these two properties for the datasets used by the report (especially the proxy dataset ,the one that links to others):

{
  "id": "f213a5d2-d028-424b-b9d4-daae68d740ea",   // your proxy dataset
  "xmlaPermissions": "ReadOnly",
  "isEffectiveIdentityRequired": true,
  "isEffectiveIdentityRolesRequired": true
}

These flags must be present on the proxy dataset entry (your main report's dataset) to correctly pass through user identity to underlying datasets.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[marcio_fornari]

Hi, doesn't work 😞 
My post has a image with 4 datasets.
1 - dataset of report
2 - Dataset 1 and Dataset 2 with RLS
3 - dataset no rls 

Download of the 4 pbix: https://easyupload.io/m/ew5xx7

POST /v1.0/myorg/GenerateToken HTTP/1.1
Host: api.powerbi.com
Authorization: Bearer xxxxx
Content-Type: application/json

BODY: 
{
  "datasets": [
    {
      "id": "f213a5d2-d028-424b-b9d4-daae68d740ea",
      "xmlaPermissions": "ReadOnly",
      "isEffectiveIdentityRequired": false, //dataset of report
      "isEffectiveIdentityRolesRequired": false //dataset of report
    },
    {
      "id": "23a0db58-fa8f-4fd5-8fae-51479d0c021a",
      "xmlaPermissions": "ReadOnly",
      "isEffectiveIdentityRequired": false, //because this dataset not have rls (dataset no rls)
      "isEffectiveIdentityRolesRequired": false //because this dataset not have rls (dataset no rls)
    },
    {
      "id": "42da3437-daf5-4f0b-b9db-dc8a6d7211f0",
      "xmlaPermissions": "ReadOnly",
      "isEffectiveIdentityRequired": true, //this dataset has rls (dataset 1)
      "isEffectiveIdentityRolesRequired": true //this dataset has rls (dataset 1)
    },
    {
      "id": "0d100a5b-d61a-414c-ac7e-53a5d9ae75da",
      "xmlaPermissions": "ReadOnly",
      "isEffectiveIdentityRequired": true, //this dataset has rls (dataset 2)
      "isEffectiveIdentityRolesRequired": true //this dataset has rls (dataset 2)
    }
  ],
  "reports": [
    {
      "id": "fc4f1364-f740-4ddb-851c-9a17337ccd11"
    }
  ],
  "identities": [
    {
      "username": "Roma",
      "roles": [
        "regra1"
      ],
      "datasets": [
        "42da3437-daf5-4f0b-b9db-dc8a6d7211f0" //(dataset 1)
      ]
    },
    {
      "username": "Roma",
      "roles": [
        "regra1"
      ],
      "datasets": [
        "0d100a5b-d61a-414c-ac7e-53a5d9ae75da" // dataset 2
      ]
    }
  ]
}

[v-bmanikante]

Hi @marcio_fornari ,

Thanks for the detailed info and for sharing your setup!

Based on your current request and the behaviour you're seeing ("Error fetching data for this visual"), here are some key things to check and adjust:

1. isEffectiveIdentityRequired / isEffectiveIdentityRolesRequired on Proxy Dataset Even if the proxy dataset (your report's dataset) doesn’t have RLS itself, these two flags must be set to true because it's proxying identity to downstream datasets that do have RLS.

So this is the correction you need to make:

{
  "id": "f213a5d2-d028-424b-b9d4-daae68d740ea",  // Proxy dataset
  "xmlaPermissions": "ReadOnly",
  "isEffectiveIdentityRequired": true,
  "isEffectiveIdentityRolesRequired": true
}

2. identities section must include ALL datasets requiring RLS

You're currently passing separate identities for each RLS dataset , that’s okay(both can work). But you can also combine them into a single entry like this:

{
  "username": "Roma",
  "roles": ["regra1"],
  "datasets": [
    "42da3437-daf5-4f0b-b9db-dc8a6d7211f0",
    "0d100a5b-d61a-414c-ac7e-53a5d9ae75da"
  ]
}

This ensures consistency and is easier to manage.

3. Proxy dataset should always pass identity even if it doesn’t use it directly

That's the core reason for the "Error fetching data for this visual" in composite models with RLS

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[marcio_fornari]

Hi, i found my error. I was generating the token with "master user". Generate token with "service principal" works. I don't understand why generate token with master user doesn't work, and a question. Can i ignore the RLS with "service principal" and open the report without the filter ?

[v-bmanikante · Accepted solution]

Hi @marcio_fornari,

Thanks for the update, glad to hear you figured it out!

Yes, this behavior makes sense. When generating the embed token using a master user, there can be permission issues, especially with composite models and RLS across different workspaces. That’s why using a service principal (which is the recommended approach for embedding) worked for you.

Regarding your question : yes, you can skip RLS when using a service principal. To do that, simply don’t include the "identities" section in your GenerateToken request. If you don't pass any identities, Power BI won't apply RLS, and the service principal will see all the data in the report.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,

B Manikanteswara Reddy

[marcio_fornari]

Thanks for the support