Forum Discussion
RLS for embedded PBI reports
Hi Team,
I have a pbi report that is embedded through an in-house mobile app.
The in-house app, dedicated to mobile users is doing nothing but rendering the power bi report from the cloud into a phone (once again, not through the official pbi app but through in-house solution). The issue is as follows:
The only way for the users to see the mobile report is if i assign them workspace member status. However, this completely overrides the RLS I have assigned.
Has anyone faced this issue before? I can't get the report to render on mobile with viewer priviledge, meanwhile loading fine but without RLS when on member priviledge.
It is definetely not the in-house app issue and i think it has to do with MS forcing member priviledge for embedded reports (outside of PBI mobile app)
I am not sure how your in house developed app was developed, however you dont need to share Workspace level Member permissions to your end users to render your report content.
If your end consumers are within your organisation and You want your end users to login power bi within the mobile app then:
1. Read permissions on the report and the semantic Model.
2. Make you sure you add your users to the RLS security role you had created.
3. For the capacities which are lower than F64, end users require Power BI pro licenses to access your content
This should be enough I think
If your end consumers are outside your organisation then
1. Make sure your have hosted your report in a workspace backed by F64 or higher capacity
2. With in the app, you might have developed a custom login for authentication purposes. You need to captue the identity of your end user after login and while rendering the report you should pass the identity and RLS role name while generating the embed token.
I would suggest you to read these articles for more info
https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-customer-app
Connect on LinkedIn
Did I answer your question? Mark my post as a solution! If I helped you, click on the Thumbs Up to give Kudos.
Proud to be a Super User!
Hi SSirozza,
Thank you for engaging with the Microsoft Fabric Community. As others have mentioned, assigning Workspace Member access will bypass RLS, which is why the report loads without applying your security rules. For embedded scenarios, such as your internal mobile app, users should stay as Viewers/Readers, be assigned to the correct RLS roles, and your app should generate the embed token using the user’s identity or role. This setup ensures RLS is enforced outside of the Power BI mobile app.Helpful Reference:
Use row-level security when embedding paginated reports - Power BI | Microsoft Learn
Power BI security white paper - Power BI | Microsoft Learn
Security in Power BI embedded analytics - Power BI | Microsoft Learn
Regards,
Yugandhar.
6 Replies
- lbendlin
Super User
What made you decide against using the native Power BI Mobile app?
- tharunkumarRTK
I am not sure how your in house developed app was developed, however you dont need to share Workspace level Member permissions to your end users to render your report content.
If your end consumers are within your organisation and You want your end users to login power bi within the mobile app then:
1. Read permissions on the report and the semantic Model.
2. Make you sure you add your users to the RLS security role you had created.
3. For the capacities which are lower than F64, end users require Power BI pro licenses to access your content
This should be enough I think
If your end consumers are outside your organisation then
1. Make sure your have hosted your report in a workspace backed by F64 or higher capacity
2. With in the app, you might have developed a custom login for authentication purposes. You need to captue the identity of your end user after login and while rendering the report you should pass the identity and RLS role name while generating the embed token.
I would suggest you to read these articles for more info
https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-customer-app
Connect on LinkedIn
Did I answer your question? Mark my post as a solution! If I helped you, click on the Thumbs Up to give Kudos.
Proud to be a Super User!
V-yubandi-msftCommunity Support
Hi SSirozza,
Thank you for engaging with the Microsoft Fabric Community. As others have mentioned, assigning Workspace Member access will bypass RLS, which is why the report loads without applying your security rules. For embedded scenarios, such as your internal mobile app, users should stay as Viewers/Readers, be assigned to the correct RLS roles, and your app should generate the embed token using the user’s identity or role. This setup ensures RLS is enforced outside of the Power BI mobile app.Helpful Reference:
Use row-level security when embedding paginated reports - Power BI | Microsoft Learn
Power BI security white paper - Power BI | Microsoft Learn
Security in Power BI embedded analytics - Power BI | Microsoft Learn
Regards,
Yugandhar.- V-yubandi-msft
Hi SSirozza ,
Could you let us know if your issue has been resolved or if you are still experiencing difficulties? Your feedback is valuable to the community and can help others facing similar problems.
- V-yubandi-msft
Hi SSirozza ,
I wanted to check in regarding your issue. Has it been resolved, or do you need any further information. Let me know if you’d like more details.
Thanks.
- V-yubandi-msft
Hi SSirozza ,
Has your issue been resolved, or are you still having any difficulties? If you need more information or help, please let us know.
Thanks
