Multi-tenancy with Power BI Embedded

[martinknafve]

I'm trying to wrap my head around how to use Power BI Embedded in a multi-tenant environment.

I've done the following:

1. Set up a PowerBI embedded Workspace collection and workspace
2. Uploaded a PowerBI Desktop File (.pbix) to the workspace
3. Configured the data source for the data set (SQL Database)
4. Created a PowerBI token and been able to generate a report in my Web App

Now I'm trying to understand how to make this solution tenant-aware. Let's say I have 10 000  users who I want to display my report to, but I want them to see different data in the report since their access differs.

I could create 10 000 separate PowerBI Desktop Files showing the different reports, and then, depending on which user is logged on to my application show the different reports. This would of course not be a scalable method to maintain.

I've read that there is a Row-Level Security available, but it's not clear to me whether I can currently configure RLS for data sets set-up in a Azure Power BI Workspace. Is there a way to do this? (I understand that RLS is still in preview). If not, how do one currently accomplish multi-tenancy with Power BI Embedded?

[dhruvsakalley]

https://docs.microsoft.com/en-us/azure/power-bi-embedded/power-bi-embedded-rls

This seems to be available now. Can someone confirm if this solves the above problem.

[Anonymous]

Fast forward to the Q&A in the video mentioned here

http://community.powerbi.com/t5/Developer/Power-BI-Embedded-access-control/m-p/27332

They are working on it.

[Greg_Deckler]

I do not believe that RLS is supported by Power BI embedded. They just extended RLS to content packs:

https://powerbi.microsoft.com/en-us/documentation/powerbi-service-whats-new/

One route to go would be to publish your dashboard/report in the Service, configure RLS and then share it with everyone. 

Before that, you had to create a separate report and dashboard for each role/customer.

[antpstevens]

Thanks.. have you confirmed this works?   i.e.. 1 report and RLS implemented for Azure SQL server and effectively then we have secure multi-tennancy?  Is there anything else published to guide on this approach.  I've been looking everywhere so would appreciate any further help.

Also, assuming you have RLS in place on Azure SQL Database, how do you pass the userID to the embedded PowerBI? 

[Greg_Deckler]

Yes, I have done RLS with a dataset and it worked, although that dataset originated from a CSV file so I imported it into Desktop and then published to Service.

Here is a recent blog article on it:

http://community.powerbi.com/t5/Community-Blog/Row-Level-Security-in-Power-BI/ba-p/31031

They just released RLS like this month so it is pretty new.

[martinknafve]

> antpstevens:
> Also, assuming you have RLS in place on Azure SQL Database, how do you pass the userID to the embedded PowerBI?

As far as I know, you can't do this with Power BI Embedded. If you're using Power BI Embedded, you can use the PowerBI Embedded REST API to configure that a specific SQL Database user account should be used when accessing a specific data set (by configuring the data set gateway with basic authentication). Using SQL Database RLS, you could filter the data visible to the users viewing the report. But this configuration will then be shared by all end-users viewing the report, which means that all users would use the same SQL Database user account and hence see exactly the same data. Also, if you change the user account configured for the data set, it seems like there's some initial refresh/caching issue, so if a user views the report, he would see old cached data for a few seconds before the data is refreshed and the new SQL database user credentials is taken into account. In other words, this looks like a no-go.

Also, be aware that there are really two different RLS's being involved here. The Power BI Service has it's own RLS-implementation. Using the Power BI Service web UI you can set up roles and link users to these roles. And then you can set up rules for the roles, defining what data should be shown. But this has nothing at all to do with the Azure SQL Database RLS. So if you you think about Azure SQL Database RLS and ask someone if Power BI Service supports RLS, and they say "yes", you should know that they might be talking about Power BI RLS and not SQL Database RLS.

> smoupre
> One route to go would be to publish your dashboard/report in the Service, configure RLS and then share it with everyone.

But then I would not be using Azure Power BI Embedded, and I could not embed the report in my web application, right? I have tens of thousands of users on thousands of companies, most of which probably does not have a Power BI Service/Office 365 user account. So the user experience would not be so good if they had to sign up on Office 365 just to see some reports.

[Greg_Deckler]

@martinknafve - Correct, if you use the Power BI Service, you are not using Power BI Embedded. Until Power BI Embedded supports RLS (if) and you can pass it individual user credentials or identifier, within your program, then the Service and its RLS is basically the only route to go at this point without building out dashboards/reports for each user. Power BI Embedded and Power BI RLS are really very new, as in this month, but are evolving quickly.