Power BI Embedded App owns data - RLS - username get

[dpombal]

Hi all,

We are trying to embed a power bi report using App Owns Data strategy,  but we are struggling with getting the username that is viewing the report, our application already sends the identity property while obtaining the guest token, but the DAX USERNAME() and USERPRINCIPALNAME() functions return the Application Id (from entra ID) instead of the username field from the identity property.

Microsoft documentation advises to user USERNAME() but it is not working in our usecase.

Example we are obtaining Application id

XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

instead of

johnstones@myorganization.com

Regards, thanks for your help

[v-nmadadi-msft]

Hi  @dpombal  ,
Thanks for reaching out to the Microsoft Fabric Community forum. 

When a report is accessed through an embedded application that authenticates with a service principal, USERPRINCIPALNAME() and USERNAME() return the service principal's application ID or an empty string not an end user's identity.

These functions don’t return the end user identity and therefore can’t be used for per-user filtering in service principal embedding scenarios. This means dynamic RLS filters based on these functions won't filter data per user in embedded scenarios.

To apply per-user RLS in embedded scenarios, use the effective identity feature of the Power BI REST API. Pass the EffectiveIdentity object with the appropriate username and roles when generating an embed token. If your RLS rules use CUSTOMDATA(), pass the custom data string through EffectiveIdentity.CustomData.

For more information, Please check:Security in Power BI embedded analytics - Power BI | Microsoft Learn

I hope this information helps. Please do let us know if you have any further queries.
Thank you