RLS with Power BI Embedded Premium Question?

[rasta123]

We are working with Power BI Premium Embedded and want to implement RLS based on Roles, this was available in previous Power BI Embeded service on Azure following the below documentation:

https://docs.microsoft.com/en-us/azure/power-bi-embedded/power-bi-embedded-rls 

in the example from the above link we could use this passing the Role with method below:

var embedToken = PowerBIToken.CreateReportEmbedToken(this.workspaceCollection, this.workspaceId, report.Id, "Andrew Ma", ["Manager"]);'

This does not appear to be available yet and based on what we read it appears it is due this quarter or possibly in a July update.  Can anyone confirm when this will be available via preview or in production?

[rasta123]

We have succesfully got this working with Azure SQL with an embedded project and have purchased an Premium EM1 SKU to get started.  My next questions is how does the sku get associated with our account and how would we monitor usage on the account just like any other Azure usage?  I assume the SKU is connected to our Office 365 domain and somehow uses that, but not sure how to validate and monitor embedded usage.

[nimrod]

After purchasing a SKU, you need to assign the relevant workspace to the capacity you purchased.

It can be done through the Admin Portal in the PBI Portal.

Read more about it here- https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-premium-manage/#assign-a-workspace-t...

[yuryb]

Yes, currently this is not supported but we're working to enable RLS for the new embedding API. First this will be supported for reports based on Power BI models (not AS on-prem or AS Azure live connections). The RLS roles and username will be passed as additional parameters to GenerateToken API. The current plan is to make this available in August.

Best regards

[fbeekvel]

Hi @yuryb

Do you have any idea (rough ballpark) when RLS will be available for live Azure AS connections?

[avive]

Hi,

We do not have a date to share yet for PBI Embedded with RLS connecting to AS Azure

[Oulak]

Hi,

Do you have any idea when RLS will be available for live on premise SSAS connections?

We have a proof of concept (app owns data) that depends on this, and are stuck at the moment.

Kind regards,

[nimrod]

We have support for Analysis Services live connections now. See more here- https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/#working-with-analy...

[Oulak]

Hi nimrod,

We're currently trying to implement RLS with Embedded and SSAS but encountered the issue stated above.

While your post gave me hope to be able to go forward, the documentation says the following about the effective identity passed to the GenerateTokenRequest method:

From https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls: "The effective identity that is provided for the username property must be a windows user with permissions on the Analysis Services server."

var generateTokenRequestParameters = new GenerateTokenRequest("View", null, identities: new List<EffectiveIdentity> { new EffectiveIdentity(username: "username", roles: new List<string> { "roleA", "roleB" }, datasets: new List<string> { "datasetId" }) });

So the "username" value should match a Windows user with access on SSAS ?

This would lead me to believe that the "app own data" scenario isn't supported with Embedded and SSAS using RLS.

Is it a correct assumption ? If so, is it only temporary ?

Not having this feature will unfortunately bring our Embedded development to a full halt.

Kind regards,

[mido]

Hey

For non windows users go with the CUSTOMDATA function. If I understand you correctly this is exactly what you're after?

Check Kaspers post here -

https://www.kasperonbi.com/using-customdata-and-ssas-with-power-bi-embedded/

Hth

[Oulak]

Hi,

I wasn't aware of the CUSTOMDATA function, which seems to be very interesting for non Windows users indeed.

Altough it didn't help with the RLS implementation we chosed up until now : passing a filter key as the user identity and a filter id as role, and managing the roles at report level.

We now make the distinction between reports using SSAS and other ones and adapt ou RLS accordingly.

The specific issue faced regarding the RLS and SSAS was solved by multiplying SSAS roles 🙂

Kind regards,

[berhir]

Hi @yuryb and @avive,

I am currently working on a very similar scenario as rasta123.

We have a multi-tenant web app and want to provide a single report that shows only the data for the current tenant.

The data is stored in a Sql Azure DB and we use direct query to get the data into the report.

We have already embedded the report and everything works fine so far.

The only missing piece to make it available to our customers is RLS.

@yuryb said there will be an update in August that brings RLS to the new API. Is my scenario possible with this update? And do you already have a date?

Thanks!

[avive]

RLS is out, read about it here: https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-embedded-rls/

and also about the updates to the GenerateToken API that goes with it: https://msdn.microsoft.com/en-us/library/mt784614.aspx

[nicksav]

Hi Avive

Still can't find info on how to generate an embeeded token with Roles for Tiles and Dashboards?

Is there any time line to support this?

Thanks

Nick

[avive]

Yes you are right, RLS for tiles and dashboards is not yet available, it is being worked at as we speak... you will see an update when we are ready to go

[Geronimo]

Hello,

Will RLS for Dashboard and Tiles appear at the same time, or will Tiles be first supported for RLS ? Any prespective (short, mid, long term) would be greatly appreciated.

BR

[yuryb]

Hello,

We expect RLS for both tile and dashboard to be available in Q4.

Best regards

[nicksav]

Any news on RLS. Almost end of Q4

[avive]

RLS news is updated regularly each month through our developer comunity update blogs, here is the link to the latest

https://powerbi.microsoft.com/en-us/blog/power-bi-developer-community-november-update/  

[nicksav]

Looks like a broken link?
I nean RLS for dashboards.

[avive]

link fixed

RLS for tiles and dashboards will become available in JAN