RLS for embedded PBI reports

[SSirozza]

Hi Team,

I have a pbi report that is embedded through an in-house mobile app.

The in-house app, dedicated to mobile users is doing nothing but rendering the power bi report from the cloud into a phone (once again, not through the official pbi app but through in-house solution). The issue is as follows:

The only way for the users to see the mobile report is if i assign them workspace member status. However, this completely overrides the RLS I have assigned. 

Has anyone faced this issue before? I can't get the report to render on mobile with viewer priviledge, meanwhile loading fine but without RLS when on member priviledge. 

It is definetely not the in-house app issue and i think it has to do with MS forcing member priviledge for embedded reports (outside of PBI mobile app)

[tharunkumarRTK · Accepted solution]

@SSirozza 

I am not sure how your in house developed app was developed, however you dont need to share Workspace level Member permissions to your end users to render your report content. 

If your end consumers are within your organisation and You want your end users to login power bi within the mobile app then:

1. Read permissions on the report and the semantic Model.

2. Make you sure you add your users to the RLS security role you had created. 

3. For the capacities which are lower than F64, end users require Power BI pro licenses to access your content

This should be enough I think

If your end consumers are outside your organisation then 

1. Make sure your have hosted your report in a workspace backed by  F64 or higher capacity 

2. With in the app, you might have developed a custom login for authentication purposes. You need to captue the identity of your end user after login and while rendering the report you should pass the identity and RLS role name while generating the embed token. 

I would suggest you to read these articles for more info

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-customer-app

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!

[V-yubandi-msft]

Hi @SSirozza ,

Has your issue been resolved, or are you still having any difficulties? If you need more information or help, please let us know. 

Thanks

[V-yubandi-msft]

Hi @SSirozza ,

I wanted to check in regarding your issue. Has it been resolved, or do you need any further information. Let me know if you’d like more details.

Thanks.

[V-yubandi-msft]

Hi @SSirozza ,

Could you let us know if your issue has been resolved or if you are still experiencing difficulties? Your feedback is valuable to the community and can help others facing similar problems.

[V-yubandi-msft · Accepted solution]

Hi @SSirozza,
Thank you for engaging with the Microsoft Fabric Community. As others have mentioned, assigning Workspace Member access will bypass RLS, which is why the report loads without applying your security rules. For embedded scenarios, such as your internal mobile app, users should stay as Viewers/Readers, be assigned to the correct RLS roles, and your app should generate the embed token using the user’s identity or role. This setup ensures RLS is enforced outside of the Power BI mobile app.

Helpful Reference:
Use row-level security when embedding paginated reports - Power BI | Microsoft Learn
Power BI security white paper - Power BI | Microsoft Learn
Security in Power BI embedded analytics - Power BI | Microsoft Learn

Regards,
Yugandhar.

[tharunkumarRTK · Accepted solution]

@SSirozza 

I am not sure how your in house developed app was developed, however you dont need to share Workspace level Member permissions to your end users to render your report content. 

If your end consumers are within your organisation and You want your end users to login power bi within the mobile app then:

1. Read permissions on the report and the semantic Model.

2. Make you sure you add your users to the RLS security role you had created. 

3. For the capacities which are lower than F64, end users require Power BI pro licenses to access your content

This should be enough I think

If your end consumers are outside your organisation then 

1. Make sure your have hosted your report in a workspace backed by  F64 or higher capacity 

2. With in the app, you might have developed a custom login for authentication purposes. You need to captue the identity of your end user after login and while rendering the report you should pass the identity and RLS role name while generating the embed token. 

I would suggest you to read these articles for more info

https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-customer-app

Connect on LinkedIn

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!

[lbendlin]

What made you decide against using the native Power BI Mobile app?