Forum Discussion
Power BI iframe embedding issue with Microsoft Defender Cloud Apps (MCAS) – repeated sign-in loop
Hey Chetan40,
Here are the answers:
- Is MCAS causing the issue? Yes. When MCAS is enabled, the URL changes to https://app.powerbi.com.mcas.ms, and the reverse-proxy intercepts browser authentication, causing login loops in iframes.
- Configuration changes needed:
- Exclude embedded report users from the Conditional Access app control policy
- Adjust MCAS session policies to target only high-risk scenarios (downloads of sensitive content)
- Alternatively, use Service Principal tokens for secure server-side embedding
- Specific policies to adjust:
- Conditional Access: Add excluded users/groups from "Use Conditional Access App Control"
- MCAS Session Policies: Scope to sensitivity-labeled content only, not all Power BI traffic
- Recommended approach: Create a tiered strategy with the help of a Power BI consulting firm, maintain MCAS controls for direct Power BI access while excluding embedded users from proxy interception or using token-based embedding.
Hi Chetan40,
Thank you for the response. Yes looks like this behaviour confirms that Microsoft Defender for Cloud Apps session control(reverse proxy) is causing the iframe login loop.
- Excluding the embedding users from the Conditional Access policy should resolve the issue, as it avoids the .mcas.ms rewrite and allows authentication to complete inside the iframe.
- No additional MCAS configuration is required, just make sure no other Conditional Access policies are still applying session control.
Thanks and regards,
Anjan Kumar Chippa
Thank you, Anjan. This was very helpful.
We are currently facing an issue while embedding reports from Power BI Service using the User Owns Data approach.
When Microsoft Defender for Cloud Apps (session control / reverse proxy) is enabled for Power BI:
- The embedded report inside iframe keeps looping on the “Sign in” page (screenshot attached)
- After clicking Sign in, it redirects and again comes back to the same login screen
- However, clicking “Open in new tab” works perfectly fine
For reports/workspaces where MCAS is not enabled, embedding works correctly in the same tab without any issue.
If we exclude embedding users from Conditional Access (MCAS session control):
- Will this fully resolve the iframe login loop issue?
- Or are there additional configurations required (e.g., trusted domains, browser/session settings, etc.)?
Thanks,
Chetan
Hi Chetan40,
Thank you for the response. Yes looks like this behaviour confirms that Microsoft Defender for Cloud Apps session control(reverse proxy) is causing the iframe login loop.
- Excluding the embedding users from the Conditional Access policy should resolve the issue, as it avoids the .mcas.ms rewrite and allows authentication to complete inside the iframe.
- No additional MCAS configuration is required, just make sure no other Conditional Access policies are still applying session control.
Thanks and regards,
Anjan Kumar Chippa