Fabric Metrics App question

So I have a question with the app, particularly when you drill through a specific timepoint. We are trying to figure out what users are actually doing on Interactive Operations that generates a 'Failure' status. In order to question them, we would need to identify who are interacting with the report/dashboard first, so in comes the question. What is being passed to the 'User' field for embedded reports? Usually, this field contains the UPN for the user who access the report. But what of reports embedded using a Service Principal? This particular report I am talking about is embedded to one of our internal sites using a service principal. Users login to the internal site using their NT credentials and there seems to be a background query to display there name and employee IDs. Based from what I'm seeing, the User field seems to be showing employee IDs that accessed embedded reports. Just want to confirm if someone knows.