Power BI Embedded Composite model embed token with RLS causes OnPremiseServiceException visual error

[olaamigo]

i,

I am embedding a Power BI report using GenerateToken (App owns data scenario).

The report is based on a composite model:

Main report dataset

DirectQuery to multiple Power BI semantic models

Some downstream datasets have RLS roles

I generate the embed token using this request body

{

"reports": [

{

"id": "REPORT_ID"

}

],

"datasets": [

{ "id": "DATASET_A", "xmlaPermissions": "ReadOnly" },

{ "id": "DATASET_B", "xmlaPermissions": "ReadOnly" },

{ "id": "DATASET_C", "xmlaPermissions": "ReadOnly" },

{ "id": "DATASET_D", "xmlaPermissions": "ReadOnly" },

{ "id": "DATASET_E", "xmlaPermissions": "ReadOnly" }

],

"identities": [

{

"username": "mock_user@tenant.com",

"roles": ["Read"],

"datasets": [

"DATASET_C",

"DATASET_D",

"DATASET_E"

]

}

]

}

Token gets generated and i tried to spin up in python in local VS code to test the embedding

Notes:

-xmlaPermissions are included because this is DirectQuery to Power BI semantic models

RLS role "Read" exists only on downstream datasets

The main composite dataset does not have RLS

When embedding the report, some visuals fail with:

VisualErrorSeeDetails_OnPremiseServiceException

The report works in Power BI Service and developer playground but fails in embedded in my local server in python

Questions:

1. Should the main composite dataset also be included in identities.datasets even if it has no RLS?

2. Do I need anything else ?

3. Is there any known limitation with composite model + RLS + embed token?

Error text

Unable to retrieve the data for this visual effect. Please try again later.

Please check the technical details for more information. Please provide these details if you contact support.

Hide details

Underlying errorOnPremiseServiceException

Any guidance would be greatly appreciated.

[v-echaithra]

HI @olaamigo ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-echaithra]

Hi @olaamigo ,

We’d like to follow up regarding the recent concern. Kindly confirm whether the issue has been resolved, or if further assistance is still required. We are available to support you and are committed to helping you reach a resolution.

Thank you.

[v-echaithra · Accepted solution]

Hi @olaamigo ,

In addition to including the main dataset in the identity, I would recommend validating the following areas to ensure the security context is resolved correctly across the composite model:

Please confirm that the role "Read" exists across all downstream datasets referenced in the DirectQuery chain. If the role is missing or defined differently in any dataset, it can lead to partial query failures at runtime.

Ensure that all datasets involved in the composite model are included in both:
the "datasets" section of the token request
and the identities.datasets array. This includes the main dataset as well as all referenced semantic models.

Your use of "xmlaPermissions": "ReadOnly" is correct for DirectQuery to Power BI semantic models. Please ensure this is consistently applied to every dataset in the request.

Even if a dataset does not have RLS configured, it still needs to be included in the identity scope. In composite models, Power BI requires a unified identity across all participating datasets to execute queries successfully.

Best Regards.

[rohit1991]

Hii @olaamigo 

In a composite model with RLS, all datasets involved in DirectQuery (including the main dataset) must be explicitly included in the embed token identities; otherwise, Power BI cannot resolve security context across datasets, leading to OnPremiseServiceException. Even if the main dataset has no RLS, it should still be added in identities.datasets, and the RLS role must exist consistently across all downstream datasets used in the query.

[olaamigo]

Hi,

I updated the embed token request so that the main composite dataset is also included in identities, even though it has no RLS ( the main one )

This is the current mock token payload I am using:

{
"reports": [
{
"id": "REPORT_ID"
}
],
"datasets": [
{ "id": "DATASET_MAIN", "xmlaPermissions": "ReadOnly" },
{ "id": "DATASET_X", "xmlaPermissions": "ReadOnly" },
{ "id": "DATASET_Y", "xmlaPermissions": "ReadOnly" },
{ "id": "DATASET_Z", "xmlaPermissions": "ReadOnly" },
{ "id": "DATASET_W", "xmlaPermissions": "ReadOnly" }
],
"identities": [
{
"username": "mock_user@tenant.com",
"datasets": [
"DATASET_MAIN",
"DATASET_X"
]
},
{
"username": "mock_user@tenant.com",
"roles": ["Read"],
"datasets": [
"DATASET_Y",
"DATASET_Z",
"DATASET_W"
]
}
]
}

However I am still getting the same visual failure:

VisualErrorSeeDetails_OnPremiseServiceException