Trying to get roles needed for an RLS report using the APi

[luish_castroc]

Hi,

I currently have an AppService that uses a service principal, and I'm trying to embed reports in an Angular application using a combination of a Microsoft user and a service principal to generate the embedded tokens. Everything works except that when I try to load RLS reports, I need to provide the proper roles, and I don't have an easy way to get those roles either from the user or from the PowerBI API. I have Tenant.ReadAll access, so I think that prevents me from using the admin APIs. Any advice is appreciated.

[v-nmadadi-msft]

Hi @luish_castroc 

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the community members for the issue worked. If our response addressed, please mark it as Accept as solution and click Yes if you found it helpful.

Thanks 

[v-nmadadi-msft]

Hi @luish_castroc 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If our responses has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-nmadadi-msft]

Hi @luish_castroc 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[lbendlin]

You can enumerate RLS roles in a semantic model via DMV queries.

select * from $SYSTEM.TMSCHEMA_ROLES

[luish_castroc]

Thanks for the response, im not familiar with that process since i'm using the powerbi REST api

[lbendlin]

You can run a DMV query through the REST API.

Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

[luish_castroc]

thanks but as per the documentation on the api that won't work:

 Service Principals aren't supported for datasets with RLS per RLS limitations or datasets with SSO enabled.

im using a service principal.

[v-nmadadi-msft]

Hi @luish_castroc 
If you have only a few RLS groups, a practical workaround is to create separate reports for each group and embed them individually, sharing each group's report accordingly, however, if there are many RLS groups, this approach becomes unmanageable and is not a suitable solution and if the feature is really important to you, Please raise a post in ideas forum
Fabric Ideas - Microsoft Fabric Community
to allow the use of service principal with RLS.

If you find this post helpful, please mark it as an "Accept as Solution" and consider giving a KUDOS. Feel free to reach out if you need further assistance.
Thank you