Unable to get RLS security to work with an “app owns data” embedded PBI using Azure Analysis Service

Hi opensky,

The documentation is quite clear.

1. Please refer to developer/embedded-row-level-security#considerations-and-limitations.

>>>Azure Analysis Services live connections support filtering by roles, but not dynamic by username. Dynamic filtering can be done using CustomData.

2. Please refer to the blue Note in embedded-row-level-security#working-with-analysis-services-live-connections.

>>>The CustomData feature will only work for models that reside in Azure Analysis Services, and it only works in live mode. Unlike users and roles, the custom data feature can't be set inside a .pbix file. When generating a token with the custom data feature you must a have user name.

Best Regards,

Dale

Hi opensky

There are a couple of settings that you need to get right . 

In the below representation of embed token "username" should always be the Master /service account which is a power bi pro account . The dataset in Power BI should be configured using this  account . 

"roles" attribute should contain the rolename that you have configured in your Azure AS model . 

"Customdata" attribute should contain the username for whom you want to process the report. 

 The DAX expression for the AS ROLE   should use CUSTOMDATA() function instead of USERNAME()

. 

formData = {

  "accessLevel": "View",

  "identities": [

    {

     "username": master/Service account,

     "roles": [ rolename ],

     "customData":[email protected],

     "datasets": [ datasetId ]

    }

  ]

}