Power BI - Export Report via Power Automate with Row Level Security

[Anonymous]

Hi, 

I am trying to export a Power BI report using the "Export to File for Power BI Reports" action via Power Automate but I am having an error "Only folder user with reshare permissions can generate embed token" when I specified the Identities Username, Dataset and Role.

I am passing the email id of any member under the same role (RLS) as the Identities Username when I encounter this error. I am wondering if I am passing the right username? Or should I pass the email id of one Master User with given sets of permission (Admin, Member, or Contributore with Reshare permission)?

Note: Service Principal cannot be used in this scenario.

Thank you in advance. 

[AmosHersch · Accepted solution]

Hi @Anonymous ,

I don't think this specific error message is related to the values you provide in the identities.

Sounds to me as if it's related to the permissions of the user who runs the flow in Power Automate. What permissions does he have in the folder of the report and dataset? Viewer/Member/Admin?

[AmosHersch]

As far as I know it depends on the connection you choose for the Power Automate step which calls the API.

I would try with a user which is a member or an admin in the relevant Power BI workspace.

[Anonymous · Accepted solution]

We found out the reason. The "Export to File for Power BI Reports" action is running in the context of the user who executes the flow instead of the connector's account. This is different from the other action who takes the context of the connector's user account instead. 

[AmosHersch · Accepted solution]

Hi @Anonymous ,

I don't think this specific error message is related to the values you provide in the identities.

Sounds to me as if it's related to the permissions of the user who runs the flow in Power Automate. What permissions does he have in the folder of the report and dataset? Viewer/Member/Admin?

[Anonymous]

Hi @AmosHersch 

Thanks for your reply. 

A service account is the identity of the Power BI connector used to trigger the "Export to File for Power BI Reports" action. The service account has only Contributor role. Does it mean that the permission is based on the authenticated user of the Power BI connector?