Forum Discussion
Power BI Embedded and Azure Active Directory Authentication
Power BI Embedded leaves authentication and authorization up to the application that it is embedded into. You Can have your users sign into your app any way you want to (including AAD) and then your app can delegate permissions to Power BI using app tokens.
We need the credential of the current authenticated user to be able to flow through so it can be passed to the credentials for the dataset level access. e.g. connection to the azure sql database. ultimately the connection to the database needs to be under the context of the current logged in user. a fixed service account will not allow sql to know what user is requesting the data so we can only send the data relevant to that user.
It sounds like a totally different scenario, and not really related to authentication. As far as I know user context is not available at all. Especially not in PBI Embedded, where the user is not impersonated, but a sinble application token is used. In the "conventional" version the logged in user can be used for row level security, when the datasource is an SSAS cube. But that's not applicabple here.
Folks, correct me if I'm wrong. But I thin you need a different approach here. Authentication tricks won't help you in this regard.
If you used the regular PBI and not the Embedded, then you could use the new Row Level Security feature, that is available in preview since a few weeks:
https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-rls/
But I'm afraid you cannot use it with PBI Embedded.
Instead you could use predefined filters of your own for your embedded reports / tiles based on the user context. That's not super bullet-proof, but it does the job.