How to Enable SSO in Power BI report connected to another tenant Azure SQL DB?

[Anonymous]

Hello, 

I have a power bi report connected to the Azure SQL Database (direct query mode) in the capacity (Premium) workspace. 

I have successfully Embedded that report in a web app by using service principal (app owns scenario). 

Note: Azure SQL database and Power BI capacity workspace is in a different tenant 

Now, the requirement is to apply RLS on an embed report through SSO 

So, I have followed the below steps which are described in this link 

• Registered an azure app (i.e. SQLAuthApp) in Azure SQL DB tenant with Azure SQL server API access (delegated permission) 
• Enabled Azure AD Authentication for Azure SQL DB and applied user permission-based RLS rules 
• Enabled the SSO checkbox in a Power BI report dataset connection. 

I am generating a user-specific access token through the azure app (SQLAuthApp) that can access the Azure SQL DB. 

then I am passing this access token as identityblob when I am requesting for Embed token. 

but it is throwing an error as per the below screen 

Can anyone guide me what steps i need to take to resolve this error? 

Below is the screen for a visual representation of available resources 

[V-lianl-msft]

Hi @Anonymous ,

The embed token could be generated with a valid SQL Access token as identity blob (i.e. not the user's AAD token as it is a token for the user's tenant only). Consider using on behalf authentication to get a valid SQL access token

https://docs.microsoft.com/en-us/graph/auth-v2-user 

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.