How to embed a Power BI report into a web application

Hi Elisa_Costanza 

To embed a Power BI report securely into a private web application—especially one that uses Single Sign-On (SSO) and where users should view the report seamlessly—you’ll want to use Power BI’s "user owns data" or "app owns data" embedding model, with the "app owns data" model being the right fit in most enterprise cases like yours. Since you mentioned that the client has Power BI Premium capacity, you're well-positioned to use the Power BI REST APIs and service principals for scalable, secure embedding without requiring individual user Power BI Pro licenses.

Here’s how it works in practice:

Set up Azure AD and Register an Application: First, register your web application in Azure Active Directory (Azure AD) to obtain a client ID, client secret, and define permissions (e.g., Report.Read.All, Dataset.Read.All). This app will authenticate via OAuth 2.0 to generate embed tokens.

Use a Service Principal for Backend Authentication: Since users are already authenticated in your web app via SSO, you can use their identity or roles to determine access logic, but the actual Power BI interaction is done via a service principal. This avoids requiring each user to have a Power BI account.

Configure Workspaces and Reports: Make sure the Power BI report is published into a workspace that is hosted on Premium capacity. Grant the Azure AD service principal access to that workspace with at least Viewer or Contributor permissions.

Generate Embed Tokens: In your backend, use the Power BI REST API to generate an embed token for the report. This token securely grants the front-end user access to the report based on the roles and dataset access you define. The token is passed to the frontend where Power BI JavaScript SDK loads the report.

Embed with JavaScript SDK: In the front-end of the web application, use the Power BI JavaScript SDK (powerbi-client) to render the report inside an iframe or component. The user will see the report as soon as they enter the "Dataplatform" section, using the embed token issued from the backend.

Row-Level Security (Optional): If users should see only a subset of data, implement Row-Level Security (RLS) in your dataset and pass the effective identity of the user when generating the embed token (e.g., their email or role from your SSO system).