Problem with customData on chained/composite datasets on embedded viewing

[MuriloMielke]

This is about embed reports on a app owns data scenario.

I have a report with a dataset that uses rls/customData to decide what to show.  This is the payload I use on /generateToken for it:

{
  "reports": [
    {
      "id": "d19ff40a-49ad-xxxx-xxxx-xxxxxxxxxxxx",
      "workspaceId": "b2158243-0f6f-xxxx-xxxx-xxxxxxxxxxxx",
      "allowEdit": false
    }
  ],
  "datasets": [
    {
      "id": "27cc6d1e-1eeb-xxxx-xxxx-xxxxxxxxxxxx",
      "workspaceId": "b2158243-0f6f-xxxx-xxxx-xxxxxxxxxxxx",
      "xmlaPermissions": "ReadOnly",
      "identityRequired": true,
      "rolesRequired": true
    }
  ],
  "identities": [
    {
      "username": "6132105d-9fb8-xxxx-xxxx-xxxxxxxxxxxx",
      "customData": "admin@example.com",
      "datasets": [
        "27cc6d1e-1eeb-xxxx-xxxx-xxxxxxxxxxxx",
      ],
      "roles": [
        "Test"
      ]
    }
  ]
}

It works fine. The custom data shows up, and also the app's principal username as expected.

If I create another report that has its own dataset but also imports this dataset to use it, things get messed up. /generateToken requires me to pass an effective identity for the second dataset - which is expected, since it does depend on that - it will even throw an error and simply not generate a token without it. Here's a successful request payload:

{
  "reports": [
    {
      "id": "98461ad1-0be7-xxxx-xxxx-xxxxxxxxxxxx",
      "workspaceId": "b2158243-0f6f-xxx-xxx-xxxxxxxxxxxx",
      "allowEdit": false
    }
  ],
  "datasets": [
    {
      "id": "524d01a2-496d-xxxx-xxxx-xxxxxxxxxxxx",
      "workspaceId": "b2158243-0f6f-xxx-xxx-xxxxxxxxxxxx",
      "xmlaPermissions": "ReadOnly",
      "identityRequired": false,
      "rolesRequired": false
    },
    {
      "id": "27cc6d1e-1eeb-xxxx-xxxx-xxxxxxxxxxxx",
      "workspaceId": "b2158243-0f6f-xxx-xxx-xxxxxxxxxxxx",
      "xmlaPermissions": "ReadOnly",
      "identityRequired": true,
      "rolesRequired": true
    }
  ],
  "identities": [
    {
      "username": "6132105d-9fb8-xxxx-xxxx-xxxxxxxxxxxx",
      "customData": "admin@example.com",
      "datasets": [
        "27cc6d1e-1eeb-xxxx-xxxx-xxxxxxxxxxxx"
      ],
      "roles": [
        "Email"
      ]
    }
  ]
}

But the customData/username info doesn't actually 'reach' the imported dataset when I try to outputs its calculated columns that use the CUSTOMDATA() and USERNAME() native functions. customData shows up empty, and username gets the value of the tenant id/client id, which is super weird.

I could not find anything on the official docs about this limitation on embedded's customData/username, but I also couldn't find anyone that got this working either.

Am i doing something wrong? How to get the data to reach the second dataset? Or if this is simply not supported, can someone point me to the official documentation (or even a staff post) about it? I'm going insane.

[v-veshwara-msft]

Hi @MuriloMielke ,

Thanks for sharing the detailed scenario.

You're right in observing that when using composite models, where one dataset imports another, the identity context passed during embedding, including customData and username, does not reach the imported (remote) dataset.

Even though you’re including the identity object correctly in the embed token, the remote dataset won’t evaluate expressions like CUSTOMDATA() or USERNAME() based on it. This happens because RLS and identity functions are only evaluated within the dataset where they are defined, and they don’t pass through to other datasets that are connected or imported into the main model.

This behavior is consistent with the limitations documented here: Use composite models in Power BI Desktop - Power BI | Microsoft Learn

If you need the identity context to apply to both datasets, you’ll have to implement RLS separately in each dataset or consider flattening the model so everything resides in one semantic model.

Hope this helps. Please reach out for further assistance.
If this post helps, then please consider to Accept as the solution to help the other members find it more quickly.

Thank you.