Row level security with Premium embedded with live connection to on premise SSAS tabular????

[robrien6]

i,

We are looking to deploy power bi reports to Premium embedded workspaces in the service.  The reports will be embedded in a website with application based authentication (*not Active Directory*) to serve B2B reporting.

The data for the reports will be served from a live connection to on-premise SSAS tabular cubes.

The clients for the reports are external users and the data in the cube is filterable based on their application userid.

Question:  Is it possible to securely filter the reports so that cutomers using them can *only* see the data for their role / company?

It seems that SSAS tabular getToken method only supports passing a username that is an AD user (with our clients are not) so normal RLS doesnt work.

How is secure RLS with on premise SASS and Power BI premuim possible??

[v-ljerr-msft · Accepted solution]

Hi @robrien6,

Based on my research, there should be two alternative options to implement RLS for non AD users with Power BI Embedded currently. 

• Using CUSTOMDATA and SSAS with Power BI Embedded
• Use Filters to pass a filter key as the user identity and a filter id as role, and manage the roles at report level.

Regards

[robrien6]

The custom data solution looks pretty good!

Is this at all supported?  We can't use the filters property as it seems like these can be manipulated in the browser etc to strip them out, which would give end users access to more data than they are allowed.

any probelms using the Customdata() property that you can think of?

Many thanks for you contrib!

[v-ljerr-msft]

Hi @robrien6,

---

Is this at all supported?  We can't use the filters property as it seems like these can be manipulated in the browser etc to strip them out, which would give end users access to more data than they are allowed.

---

Adding filter should be supported. Though I am not very familiar with JS, I think there is possibility that the filters could be changed by changing the script in browser as you mentioned.

---

any probelms using the Customdata() property that you can think of?

---

It seems to me that it's kindly the same as the normal RLS which filters data at dataset, and it's a safer way to go. 

Regards