Embed Vs Get Report in Group w/ RLS

[Xaraja]

We are trying to display a particular Power BI report in a dashboard that is within another application. The constraints are that there are approximately 150 free users who would be accessing the report (it's in a Fabric capacity workspace) and so they normally access it via a Power BI app, and second it has row level security applied which needs to be carried over to the dashboard. We use Azure for SSO including in this other application so that's not an issue.

With the Get Report in Group REST API method, I haven't been able to find any way of passing the user's identity as a parameter so that RLS can be respected. Is that possible? Maybe with a different method I haven't found?

With going directly to the report and copying the embed link, that works fine with the other application and the report pulls up with no problem. The issue is that our free users are not members of the workspace and don't have direct access to the reports in that way, so it gives them a message that they don't have access to the report and to request access from the administrator. I couldn't find anything about this in the documentation, so again, I'm not sure if there's a work around for this. I think if we add them to the workspace that negates RLS so I must be missing something.

[v-agajavelly]

Hi @Xaraja ,

The only way to get your scenario working with free users and still have RLS respected is to either.

1. Publish the report to a Power BI App (workspace in Fabric capacity) and give those ~150 users access to the App. They’ll open it from your other application via the App link, sign in with Azure AD, and RLS will apply automatically.
2. Or go the App Owns Data route, where your app generates embed tokens with the user’s identity (effectiveIdentity) and passes it to Power BI so RLS works but this requires custom backend code.

As per my understanding you can’t pass a user identity with Get Report in Group. If you want “no coding,” publish to an App and give those users App access  that will keep RLS intact and work with your Fabric capacity.

Hope that clears things up. If the above solution works for you, please accept it as the solution so that other community members with similar issues can benefit.

Thanks,
Akhil.

[Xaraja]

We do use Power BI Apps - our Pro users who develop reports publish them to apps within the Fabric workspaces and then the free users go to the Apps tab in Power BI and access the appropriate app for their work. But I didn't find a way to get an embed link for the actual app like you can for the report. I did see in the Microsoft documentation mention of a Microsoft Entra app, is that what you are referring to, rather than the Power BI app? Or is there a way to get an embed link for the actual Power BI app?

[GilbertQ · Accepted solution]

Hi @Xaraja 

What happens if you add the users with the view role to the workspace? That should allow them to be able to view the report with the permissions and still respect row level security.

[Xaraja]

I found it worked if I added the users as "view" to the workspace, or if I went to the report itself, to the 3 dots menu, and selected Manage Permissions, and added them there. We think that will cause less confusion for users since they won't suddenly see new workspace(s) in their menu, so we're going to use that as the solution, and it has the benefit of being completely no code - just get the embed link from Power BI and paste it into the dashboard in the other program.