Forum Discussion
Power BI Embedded for customers security question
Hi Erkko,
Thank you for reaching out to the Microsoft Fabric Forum Community.
In Power BI Embedded you can enforce multi‑tenant isolation by combining a single Dynamic Row‑Level Security (RLS) role in the dataset with an embed token that carries the viewer’s Customer ID. You create one RLS role in Power BI Desktop—e.g. CustomerRole whose filter is [CustomerID] = CUSTOMDATA(). When each user signs in to your SaaS app, your back‑end calls GenerateToken and, in the effectiveIdentity, supplies that role plus a customData value equal to the user’s Customer ID (or a comma‑separated list of IDs for resellers). Because CUSTOMDATA() is populated from the signed token, Power BI automatically filters the dataset so the report renders only the rows whose CustomerID matches the value in the token—no extra code or
slicers required, and users cannot tamper with the filter. This lets a single published report securely serve every customer while minimizing maintenance and license overhead.
Thank you & best regards,
Prasanna Kumar
Hi Erkko,
Thank you for reaching out to the Microsoft Fabric Forum Community.
In Power BI Embedded you can enforce multi‑tenant isolation by combining a single Dynamic Row‑Level Security (RLS) role in the dataset with an embed token that carries the viewer’s Customer ID. You create one RLS role in Power BI Desktop—e.g. CustomerRole whose filter is [CustomerID] = CUSTOMDATA(). When each user signs in to your SaaS app, your back‑end calls GenerateToken and, in the effectiveIdentity, supplies that role plus a customData value equal to the user’s Customer ID (or a comma‑separated list of IDs for resellers). Because CUSTOMDATA() is populated from the signed token, Power BI automatically filters the dataset so the report renders only the rows whose CustomerID matches the value in the token—no extra code or
slicers required, and users cannot tamper with the filter. This lets a single published report securely serve every customer while minimizing maintenance and license overhead.
Thank you & best regards,
Prasanna Kumar
Hi! We got everything working with the normal PBI reports. However we need support to embed also paginated reports in app. We have looked Use row-level security when embedding paginated reports - Power BI | Microsoft Learn this document when applying the settings. We pass "identities": [ username: ] the CUSTOMDATA() value so that the paginated report would work but instead the customdata() value, the report displays some Power BI session GUID for some reason. Do you have any ideas how to get the paginated report embedding with RLS work properly?
Thank you very much in advance!