Configuring EffectiveIdentity for "Export To File In Group" API

[rvp_ordix]

I have been working on exporting a specific (non paginated) report of mine as a PNG via Power BI's REST API as part of a pipeline to automatically inform certain people at regular intervals. The relevant part here is that each exported image is supposed to show the report with different filters. Initial tests have worked decently well using the reportLevelFilters-property but since it only allows a single filter currently, I had to turn to using RLS and this I can't seem to get to work. 

The request body looks like this:

{
    "format" : "PNG",
    "powerBIReportConfiguration" : {
        "identity" : [{
            "username" : "****@********.de",
            "roles": ["RLS Dynamic"],
            "datasets": ["********-****-****-****-************"]
        }],
        "settings" : {
            "locale" : "de-de"
        }
    }
}

• Both dataset and report exist in a Fabric (Trial) Workspace
• The functionality to export images has been activated for our tenant
• The RLS Role in the request body has the same name as the role in the PowerBI Service and the Username (which represents myself) has been added manually to that role
• Accessing the API in general works if no RLS is configured, as mentioned above

I'm obviously missing or misunderstanding something, but what might that be?

[rvp_ordix · Accepted solution]

Alright, I've finally found out what's wrong, and I'm not sure if I want to be relieved or frustrated at the fix. It appears that had a typo in my request body. In the code above the effective identity was passed as a property with name "identity" when it should have been "identities" instead. 

[v-tsaipranay]

Hi @rvp_ordix ,

Thank you for reaching out to the Microsoft fabric community forum. Also thank you @Akash_Varuna for your inputs.

You've already validated key items great work so far. To help move this forward, here are some important points to consider:

1. The username used in EffectiveIdentity must match exactly what USERPRINCIPALNAME() returns in the report. Based on your notes, this seems correct.
2. Ensure the dataset is in Import or DirectQuery mode. RLS with EffectiveIdentity does not work for Live connection datasets (like those using a shared semantic model or AS live connections).
3. Fabric Trial capacity does support EffectiveIdentity, but in practice, certain advanced operations especially RLS-based exports can behave inconsistently under trial limits. If possible, test in a dedicated Fabric or Premium capacity workspace to validate.
4. Make sure the user is assigned to the RLS role in the dataset and has at least Viewer access in the workspace.

You can refer to this Microsoft documentations for further reference on using EffectiveIdentity with export APIs:
Reports - Export To File - REST API (Power BI Power BI REST APIs) | Microsoft Learn

Embed Token - Tiles GenerateTokenInGroup - REST API (Power BI Power BI REST APIs) | Microsoft Learn

I hope this will resolve your issue, if you need any further assistance, feel free to reach out.

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

Thankyou.

[rvp_ordix]

I had most of these points already checked before and using a full Capacity instead of the trial didn't change anything, sadly. After some experimenting, though, I've narrowed down the error. My failed request attempts so far where done via Postman, and it immediately worked when I tried to send the request via the API's Microsoft Learn page instead. That tells me, that the problem was probably with the Bearer Token I used for authentication.

The Bearer Token request is a separate step and authenticates itself with client_credentials to an App I registered in Azure with resource being set as https://analysis.windows.net/powerbi/api. This App has the necessary Read.All-permissions on Report and Dataset as well as user_impersonation and Users.Read (all of them as Delegated Permissions), but I have not otherwise touched role/permission-assignments there. The app is also added to the workspace as Administrator, and to the RLS role. 

Are there additional steps required that need to be configured?

[Akash_Varuna]

Hi @rvp_ordix  You might be missing an exact match between the RLS role name and the one configured in Power BI or the correct username format. Ensure the user has permissions on the dataset and is explicitly assigned to the RLS role. Confirm the dataset and workspace support EffectiveIdentity for RLS. Misconfigurations in any of these areas could prevent the feature from working properly.

[rvp_ordix]

The names of that RLS role match, I've checked that.

What would be the correct username format? To my understanding that is simply the email address of my Microsoft account. Calling USERPRINCIPALNAME() in PowerBI returns the same address. 

The user has permissions in the workspace (since that user is me, and the Fabric workspace is my own) and has also explicitely been added to the RLS role. 

How would I check if the workspace supports EffectiveIdentity? Is it a Fabric Workspace with a Fabric Capacity behind it, if that matters, but I wasn't aware of anything beyond that having to be done.