Forum Discussion

Chetan40's avatar
Chetan40
Frequent Visitor
4 months ago
Solved

Power BI iframe embedding issue with Microsoft Defender Cloud Apps (MCAS) – repeated sign-in loop

Hi Team,   We are facing an issue while embedding Power BI reports in an iframe after our client organization enabled Microsoft Fabric capacity and integrated Power BI with Microsoft Defender for C...
Need Help
  • alicegray's avatar
    alicegray
    4 months ago

    Hey Chetan40,

    Here are the answers:

    1. Is MCAS causing the issue? Yes. When MCAS is enabled, the URL changes to https://app.powerbi.com.mcas.ms, and the reverse-proxy intercepts browser authentication, causing login loops in iframes.
    2. Configuration changes needed:
      • Exclude embedded report users from the Conditional Access app control policy
      • Adjust MCAS session policies to target only high-risk scenarios (downloads of sensitive content)
      • Alternatively, use Service Principal tokens for secure server-side embedding
    3. Specific policies to adjust:
      • Conditional Access: Add excluded users/groups from "Use Conditional Access App Control"
      • MCAS Session Policies: Scope to sensitivity-labeled content only, not all Power BI traffic
    4. Recommended approach: Create a tiered strategy with the help of a Power BI consulting firm, maintain MCAS controls for direct Power BI access while excluding embedded users from proxy interception or using token-based embedding.
  • v-achippa's avatar
    v-achippa
    4 months ago

    Hi Chetan40,

     

    Thank you for the response. Yes looks like this behaviour confirms that Microsoft Defender for Cloud Apps session control(reverse proxy) is causing the iframe login loop.

    • Excluding the embedding users from the Conditional Access policy should resolve the issue, as it avoids the .mcas.ms rewrite and allows authentication to complete inside the iframe.
    • No additional MCAS configuration is required, just make sure no other Conditional Access policies are still applying session control.

     

    Thanks and regards,

    Anjan Kumar Chippa

alicegray's avatar
alicegray
Helper I
4 months ago

Hey Chetan40,

Here are the answers:

  1. Is MCAS causing the issue? Yes. When MCAS is enabled, the URL changes to https://app.powerbi.com.mcas.ms, and the reverse-proxy intercepts browser authentication, causing login loops in iframes.
  2. Configuration changes needed:
    • Exclude embedded report users from the Conditional Access app control policy
    • Adjust MCAS session policies to target only high-risk scenarios (downloads of sensitive content)
    • Alternatively, use Service Principal tokens for secure server-side embedding
  3. Specific policies to adjust:
    • Conditional Access: Add excluded users/groups from "Use Conditional Access App Control"
    • MCAS Session Policies: Scope to sensitivity-labeled content only, not all Power BI traffic
  4. Recommended approach: Create a tiered strategy with the help of a Power BI consulting firm, maintain MCAS controls for direct Power BI access while excluding embedded users from proxy interception or using token-based embedding.
Chetan40's avatar
Chetan40
Frequent Visitor
4 months ago

Thanks for the detailed explanation—this helps clarify that MCAS reverse proxy is causing the iframe login loop.

I have a few questions to implement this correctly:

  1. For excluding embedded users from Conditional Access App Control:
    • Should we exclude users at the Azure AD Conditional Access policy level, or directly within Defender for Cloud Apps session policies?
    • Do we have to exclude individual users/group too from the policy level?
  2. Regarding the URL rewrite to app.powerbi.com.mcas.ms:
    • Is there a way to bypass MCAS proxy only for iframe/embed scenarios while keeping it enabled for normal Power BI access?
    • Can this be controlled based on client app (browser vs embedded) or request type?
  3. For Service Principal / token-based embedding:
    • Will switching to “App owns data” (service principal) completely bypass MCAS session control?
    • Are there any additional Defender or Conditional Access settings required to allow this flow?
  4. In MCAS Session Policies:
    • Which specific setting causes iframe break (e.g., “Monitor all sessions”)?
    • Should we change it to apply only when sensitivity label = confidential, instead of all traffic?
  5. Is there any official Microsoft documentation or architecture guidance for:
    • Power BI embedding + Defender for Cloud Apps (MCAS)
    • Supported vs unsupported scenarios with reverse proxy

Our goal is to:
- Keep MCAS enabled for governance
- Avoid login loops in iframe embedding
- Follow a Microsoft-supported architecture

Any step-by-step guidance or policy screenshots would be really helpful.

Thanks again!

  • v-achippa's avatar
    v-achippa
    Community Support
    4 months ago

    Hi Chetan40,

     

    Thank you for reaching out to Microsoft Fabric Community.

     

    Thank you alicegray for the prompt response.

     

    Thank you for the detailed questions, please follow below:

    • Yes, Microsoft defender for cloud apps session control (reverse proxy) is the root cause, and it is not compatible with iframe embedding.
    • Exclusion should be done at the Azure AD Conditional Access policy level, by excluding specific users/groups accessing embedded reports.
    • It is not possible to bypass MCAS only for iframe scenarios because once session control is applied, the url rewrite affects the entire session.
    • Using App owns data (service principal) with microsoft power bi, bypasses the MCAS and it is the recommended secure embedding approach.
    • Adjusting MCAS session policies may reduce scope but will not reliably fix iframe login loops.

    Either exclude embedding users from session control or use service principal based embedding.

     

    For more details, please refer to below documentation:

    https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad

    https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session

     

    Thanks and regards,

    Anjan Kumar Chippa

     

    • Chetan40's avatar
      Chetan40
      Frequent Visitor
      4 months ago

      Thank you, Anjan. This was very helpful.
       
      We are currently facing an issue while embedding reports from Power BI Service using the User Owns Data approach.
      When Microsoft Defender for Cloud Apps (session control / reverse proxy) is enabled for Power BI:

      • The embedded report inside iframe keeps looping on the “Sign in” page (screenshot attached)

      • After clicking Sign in, it redirects and again comes back to the same login screen
      • However, clicking “Open in new tab” works perfectly fine

      For reports/workspaces where MCAS is not enabled, embedding works correctly in the same tab without any issue.
       
      If we exclude embedding users from Conditional Access (MCAS session control):

      • Will this fully resolve the iframe login loop issue?
      • Or are there additional configurations required (e.g., trusted domains, browser/session settings, etc.)?



      Thanks,
      Chetan

      • v-achippa's avatar
        v-achippa
        Community Support
        4 months ago

        Hi Chetan40,

         

        Thank you for the response. Yes looks like this behaviour confirms that Microsoft Defender for Cloud Apps session control(reverse proxy) is causing the iframe login loop.

        • Excluding the embedding users from the Conditional Access policy should resolve the issue, as it avoids the .mcas.ms rewrite and allows authentication to complete inside the iframe.
        • No additional MCAS configuration is required, just make sure no other Conditional Access policies are still applying session control.

         

        Thanks and regards,

        Anjan Kumar Chippa