Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Calling all Data Engineers! Fabric Data Engineer (Exam DP-700) live sessions are back! Starting October 16th. Sign up.

Reply
Bahneby
Frequent Visitor

Power BI Embedded Composite Model With RLS

Hi everyone,

 

I have two semantic models with RLS. The first semantic model has the RLS "RLS_1" and the second semantic model has the RLS "RLS_2". Then I built a composite model which has a direct query to both semantic models. It's working fine on Power BI Service.

 

But now, I have to embed it to our website.

 

Is this scenario even possible? I used the App owns Data example for .Net Core. But I always receive the error "BadRequest".

I changed the GetEmbedToken method:

 

 

public EmbedToken GetEmbedToken(Guid reportId, IList<Guid> datasetIds, [Optional] Guid targetWorkspaceId)
{
    PowerBIClient pbiClient = this.GetPowerBIClient();
    var datasetId_1_RLS = Guid.Parse("xxx..xxx");
    var datasetId_2_RLS = Guid.Parse("xxx..xxy");

    var datasetIdsRLS_1 = new List<Guid> { datasetId_1_RLS };
    var datasetIdsRLS_2 = new List<Guid> { datasetId_2_RLS };

    datasetIds.Add(datasetId_1_RLS); // RLS 1
    datasetIds.Add(datasetId_2_RLS); // RLS 2


    var rlsIdentity_1 = new EffectiveIdentity(
        username: "this.isan@example.com",
        roles: new List<string> { "RLS_1" },
        datasets: datasetIdsRLS_1.Select(id => id.ToString()).ToList()
    );

    var rlsIdentity_2 = new EffectiveIdentity(
        username: "this.isan@example.com",
        roles: new List<string> { "RLS_2" },
        datasets: datasetIdsRLS_2.Select(id => id.ToString()).ToList()
    );


    // Create a request for getting Embed token 
    // This method works only with new Power BI V2 workspace experience
    var tokenRequest = new GenerateTokenRequestV2(

        reports: new List<GenerateTokenRequestV2Report>() { new GenerateTokenRequestV2Report(reportId) },

        datasets: datasetIds.Select(datasetId => new GenerateTokenRequestV2Dataset(datasetId.ToString())).ToList(),

        targetWorkspaces: targetWorkspaceId != Guid.Empty ? new List<GenerateTokenRequestV2TargetWorkspace>() { new GenerateTokenRequestV2TargetWorkspace(targetWorkspaceId) } : null,
        
        identities: new List<EffectiveIdentity> {  rlsIdentity_1, rlsIdentity_2 }
    );

    // Generate Embed token
    var embedToken = pbiClient.EmbedToken.GenerateToken(tokenRequest);

    return embedToken;
}

 

 

 

Do you have any idea, what I did wrong?

 

Thank you!

 

1 ACCEPTED SOLUTION
AmosHersch
Microsoft Employee
Microsoft Employee

This scenario is supported. You can embed a composite model with several connected datasets, each with its own RLS context.

 

As a general note, if you receive a "bad request" try to see the response body, it sometimes has additional information for the reason Power BI claims it's a bad reques.

 

The challenge for your scenraio is generating an embed token correctly. For generating an embed token for composite model with DirectQuery connection to additional semantic models (datasets) your request should contain all dataset IDs in the datasets list, and you should specify xmlaPermissions = ReadOnly for them.

See here for example: Embed Token - Generate Token - REST API (Power BI Power BI REST APIs) | Microsoft Learn

In your case you should also add the effective identitiy of each dataset which has RLS.

View solution in original post

3 REPLIES 3
AmosHersch
Microsoft Employee
Microsoft Employee

This scenario is supported. You can embed a composite model with several connected datasets, each with its own RLS context.

 

As a general note, if you receive a "bad request" try to see the response body, it sometimes has additional information for the reason Power BI claims it's a bad reques.

 

The challenge for your scenraio is generating an embed token correctly. For generating an embed token for composite model with DirectQuery connection to additional semantic models (datasets) your request should contain all dataset IDs in the datasets list, and you should specify xmlaPermissions = ReadOnly for them.

See here for example: Embed Token - Generate Token - REST API (Power BI Power BI REST APIs) | Microsoft Learn

In your case you should also add the effective identitiy of each dataset which has RLS.

The XmlaPermissions were the problem. It's working fine now, thank you!

Anonymous
Not applicable

Hi @Bahneby ,

 

Here are some offical blogs about how to embed report with RLS. I hope they could help you.

For reference:

Security in Power BI embedded analytics - Power BI | Microsoft Learn

Using standard cloud based row-level security with embedded content in Power BI embedded analytics -...

 

Best Regards,
Rico Zhou

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 

Helpful resources

Announcements
FabCon Global Hackathon Carousel

FabCon Global Hackathon

Join the Fabric FabCon Global Hackathon—running virtually through Nov 3. Open to all skill levels. $10,000 in prizes!

September Power BI Update Carousel

Power BI Monthly Update - September 2025

Check out the September 2025 Power BI update to learn about new features.

FabCon Atlanta 2026 carousel

FabCon Atlanta 2026

Join us at FabCon Atlanta, March 16-20, for the ultimate Fabric, Power BI, AI and SQL community-led event. Save $200 with code FABCOMM.