Forum Discussion
How to implement tenant-based RLS in Power BI when users authenticate via ERP (not Power BI)?
Thanks for clarifying that users are authenticating through your ERP. In this setup, the key is to ensure Power BI receives the correct Entra identity when embedding. You can achieve this with EffectiveIdentity in Power BI Embedded, which lets your ERP pass the user’s Entra UPN into the dataset.
From there you can implement dynamic RLS by maintaining a Tenant Security table (TenantID - UPN/GroupID) and filtering your fact tables accordingly. This way, each tenant only sees their own data even though they’re logging in via ERP.
If your ERP doesn’t natively integrate with Entra ID, you will need to configure it so that the Entra identity is passed through during embedding , otherwise RLS won’t apply correctly.
Hi a_thiefffffffff,
How exactly is the data accessed in the ERP?
What is the storage mode of the models?
If the models are in import mode, then RLS needs to be handled in the model itself, which would mean that the ERP needs to somehow pass the user's identity back to the model when a user is accessing it.
If the model is in DirectLake mode, then RLS can happen at the fabric data store level (either SQL RLS at a warehouse, or OneLake Security RLS at a lakehouse) but the ERP still needs to pass through the identity of the user.
Hello, sorry for the delayed response. The requirments were changed and i have updated my question.
Please go through it once and share ur views accordingly.
