Forum Discussion
Inconsistent RLS Enforcement in Paginated Report Export Based on Workspace Role
Hi tks1011 ,
Thank you for the clarification and for sharing your detailed test results.
You are correct that in your implementation the Service Principal is only used for authentication, while the logged-in user's UPN is passed through EffectiveIdentity.
Based on the behavior you've observed, EffectiveIdentity is accepted by the paginated report export API, but RLS is not being enforced in the exported output. At this time, we have not found Microsoft documentation that explicitly confirms whether this behavior is an intended limitation or a product issue for the combination of:
Service Principal authentication, Paginated report (RDL) export, End-user UPN passed via EffectiveIdentity and RLS enforcement
The available documentation suggests that this architecture is supported in embedded scenarios, but it does not explicitly describe how EffectiveIdentity is evaluated during paginated report exports:
- https://learn.microsoft.com/en-us/power-bi/developer/embedded/generate-embed-token
- https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security
- https://learn.microsoft.com/en-us/power-bi/paginated-reports/paginated-reports-rls
Because we cannot conclusively determine from the public documentation whether this behavior is an intended limitation or a product issue, we recommend raising a Microsoft Support ticket for further investigation and product-team confirmation.
To create a Fabric or Power BI support ticket, please refer to:
https://learn.microsoft.com/en-us/power-bi/support/service-support
When raising the ticket, please include your test results and the observed behavior.
Best Regards,
Abdul Rafi
Hi andrewsommer ,
Thank you for the response. I wanted to clarify that our implementation is already using a Service Principal with client credentials (AcquireTokenForClient — OAuth 2.0 client credentials grant). The user's delegated token is never forwarded to the Power BI API. The SP token is what authenticates the export call, and the user's UPN is only passed as EffectiveIdentity inside the request payload.
We are also passing a Service Principal Profile ID for the paginated report path — so the SP is not operating with direct elevated workspace permissions either.
Despite this, we are still observing that RLS is bypassed when the end user has Admin-level access to the workspace. This is unexpected because the export is being initiated entirely under the SP + profile context, not the user's context.
To summarize our setup:
- Export API call authenticated via SP client credentials (not user token)
- SP Profile ID is being passed correctly
- EffectiveIdentity with the target user's UPN is passed in PaginatedReportExportConfiguration
- RLS is correctly enforced for Viewer-role users, but bypassed for Admin-role users
Is there something specific about how Power BI resolves identity for paginated report exports that could cause the end user's workspace role to still influence the output, even when the call is made under a SP + profile context? Any guidance would be appreciated.
What we tested and what we found
- Baseline export (no security context)
What we tried:
{
"format": "PDF"
}
Result: Success
Finding: The export pipeline, workspace access, and paginated report configuration are functioning correctly - EffectiveIdentity with only username
What we tried:
{
"format": "PDF",
"paginatedReportConfiguration": {
"identities": [
{
"username": "[email protected]"
}
]
}
}
Result: Export succeeded
Issue: No row-level filtering was applied; full dataset was returned
Finding: Passing only username does not enforce RLS for paginated report export - EffectiveIdentity with datasets
What we tried:
{
"format": "PDF",
"paginatedReportConfiguration": {
"identities": [
{
"username": "[email protected]",
"datasets": [
"dataset-id"
]
}
]
}
}
Result: Failed
Error: InvalidRequest: Exporting a paginated report with an effective identity with datasets is not supported
Finding: Dataset-scoped EffectiveIdentity is not supported for paginated report export - Passing roles
What we tried:
{
"format": "PDF",
"paginatedReportConfiguration": {
"identities": [
{
"username": "[email protected]",
"roles": [
"RoleName"
]
}
]
}
}
Result: Did not work
Issue: No RLS behavior observed
Finding: Roles do not enable RLS in the paginated export flow - Passing parameters
What we tried:
{
"format": "PDF",
"paginatedReportConfiguration": {
"parameterValues": [
{
"name": "ParameterName",
"value": "ParameterValue"
}
]
}
}
Result: Works only when parameters are pre-defined in the report
Limitation: Requires the RDL to be explicitly designed with parameters
Finding: Parameters can act as a workaround but are not a generic RLS substitute - Passing CustomData
What we tried:
{
"format": "PDF",
"paginatedReportConfiguration": {
"identities": [
{
"username": "[email protected]",
"customData": "some-value"
}
]
}
}
Result: Not applicable
Finding: CustomData works only in Analysis Services / semantic model scenarios and is not supported in this paginated export flow