How do you use RLS with Power BI Embedded???

[@allenunger]

Any examples on how to pass multiple values in the username() parameter for example I need Power BI to filter by multiple states, 'NY, NJ, CA'

[@pushpendrakumar9277]

I am trying to embed a report with RLS on a SAP fiori based web app. The C# code mentioned here doesnt help. Any other way out ?

[@irenepedro1859]

Hi! If you can change what goes in "username", meaning you can use dynamic RLS, with the code. Does this mean you only need power bi pro or premium licences for those who are going to create and share reports? How does this affect the Premium Capacity you need to buy? How can we estimate the costs of embedding the report on our web app? Thanks

[@MarusykRoman]

how to pass something more complex that a string? e.g. JSON. It's clear how to pass but how can I use it in Power BI?

[@MaheshKumar-tb6mc]

how we can implement static RLS with embedded report?

[@AyushmanBasugitam]

Guys..you and Patrick your content and stuff they're really great!

[@royzistify]

could it possible to GenerateTokenRequest using java, I am not able to find any maven dependency for this

[@seanvsn]

Hey have you solved this issue? I'm struggling too with it!

[@sergioparaiso446]

Amazing man! the problem is i had MFA enabled in azure. I have another dumb question though, after adding Roles, will it just automatically detect the users in our secured portal that matches the users in the dataset and let them view the report based on their roles?

[@cristianfreitas4166]

I have a base of 400 clients, will I have to create a license for each one to use the rls filter? the frontend filter is not secure and ends up allowing you to send any value.

[@Reality-df5ul]

Can a User impersonate as different user and then this code will create a token for that impersonate user? to impersonate user just need to pass email-id of other user?

[@zacs7971]

this was awesome. Thank you Adam!

[@LuciferMorningstar-p6b]

Am trying to just list the existing RLS roles of a dataset in my PBI user account usgin the API, but nothing so far all the suggested endpoints are not found Any help please???

[@gmkrishna143]

Hi, Is this Embedded RLS will work on 2 fields (Program code and Child code) ?

[@rvian4]

So, is possible to share reports in my web app, and people who don't have pro license see it? With RLS structured by the web app?

[@kapilmoudgil]

Hi I have a problem in getting multiple tables from a single Procedure. I have a procedure which is giving me 6 tables in return but I am able to see only one table in power bi. how to get all the tables at once in power BI.

[@517127]

Can i use this to show power bi dashboards embebbed with RLS in the website of the company where i work?

[@lukassteindl1914]

Would this also work with Direct Query against an OnPremise Analysis Server via a Data Gateway?

[@marceloferreira8066]

Hey, would it be possible to get which perspective (cube) an user selected on Excel and use it to explicit filter the cube? use-case: Perspectives just filter which structures should be shown (tables, columns, measures, etc...), however, I would like to filter my fact table based on the selected perspective. Sometimes some users that have the full permission to see the database wouldn't like to see all data in all contexts... It would be nice to filter the table lines differently per perspective.

[@simonknutzen2185]

Awesome video :) I have a question: How do I correctly combine the embed URL and the token so that I can include it into an ? The playground does this in the background but I have to do it manually and I cannot figure out how to do it. I tried it and the report is not loading, so I think the token was not placed correctly in the URL

[@GalaxyTA]

Hey, i want to use ONLY the username not the roles to filter the data in Power BI Embedded. Can you please help me with how to do it?

[@susanmahmood5528]

I was trying to understand what is the default role for user who are not assigned to any role. Have you tried that? it seems that after creating a role, all users who are not assigned to any role will have NO access to the dashboard (which is weird!) - have you tried that?

[@SG-pf1vn]

That's great but how do you get the effective usernsme in the first place? All power bi knows is service principal user which is anonymous if they don't sign to power bi how do we get the effective username? azure b2c or completely custom authentication/authorisation code? Thanks.

[@HARSHALK-s6m]

Same question from my side. Did you get any solution for it?

[@vinodbr4739]

Hello Adam, Will RLS work with Power BI Pro account on long run, Do we have any limitations with Pro account(may be like number of tokens). When we should upgrade to PBI Embedded Capacity(A1, A2)?

[@seanguerrero1187]

Great video guys! Know of any workarounds or even maybe new features that would address page-level security? I would like to give specific users access to specific pages.

[@N1L3S]

Hi! I have a report with a defined role and DAX expression "[ColumnName] = USERNAME()". I'm using app-only authentication initially, so far so good. When I call GenerateTokenInGroupAsync() in the C# API with an EffectiveIdentity, I get the following error: "InvalidRequest: Creating embed token for accessing dataset shouldn't have effective identity". Do you have any idea what I'm doing wrong?

[@muralichiyan]

Nice keep rocking … We need to buy azure embedded licenses for this ..?

[@johnnynguyen1132]

Would this method work for PBI Embedded within a PowerApps Portal?

[@biexbr]

Yoooo Patrick, this video 2 weeks ago would solve many problems to me. I had to bang my head many times to figure this out. Also, did you note that you mic is a bit weird?

[@tonytarragona6655]

would you have to add every user principal name? what about if you have about 100 users?

[@AlbertoGastaldo]

Tony, If you use embedded, username is not relavant. You can just create the role without any user inside . Then - using the code - you specify the role name you want to use. When report opens, you are part of that role, that means that you are under the RLS defined in that role.

[@GuyInACube]

Alberto is correct. You would only really need to worry about the username if you are doing dynamic row-level security. If you don't need dynamic RLS, then just focus on the roles. That being said, from a Power BI Embedded perspective, you would still need to maintain some mapping within your application to map a given logged in user to a role as that wouldn't be maintained on the Power BI side.

[@tonytarragona6655]

Thank you

[@AlbertoGastaldo]

Thanks Guy in a Cube for clarification Just to contribute to this discussion I want to mention that in my case I pass the role via code and the logged in user via customdata along with other information So I can do dynamic RLS by getting not only the user name but also other properties (for example some user preferences set in my web app) and use those values to decide filters in Dax code

[@shaheerahsan2486]

@@GuyInACube @AlbertoGastaldo what if I used static RLS on my dashboard. How will I be able to embed that in my application using tokens?

[@HONEYASET]

Can we show a message if you are not added I RLSlike "restricted contect and request for access to this content".... I have created an APP in which some reports are restricted and share with limited people but they can still see report name/pages in app and can click it but see cross error in values which is not a good user experience. Any solution to give better experience

[@PowerEliteStudio]

Thanks Adam, so clarifying

[@shaluranidj2599]

Hi Suppose if they are not users of powerbi when using rls

[@Salmah9979sun]

Thank you so much for this wonderful channel, I'm working with PowerBI Report Server, I have implemented Row-Level-Security and created one role on which every employee shall be assigned. . However, I have over 200 users using the reports. Is there a way to automatically assign every email adress of the users to this single role?

[@RKTECH1021]

I am receiving following error, what am I doing wrong? Microsoft.Rest.HttpOperationException: Operation returned an invalid status code 'BadRequest' at Microsoft.PowerBI.Api.ReportsOperations.d__34.MoveNext()

[@GuyInACube]

Usually something isn't formatted right. Could be a lot of reasons why though. I'd say to go back through and carefully look at what is being sent in the request.

[@RKTECH1021]

@@GuyInACube Thanks for the suggestion. Issues was using useRLS = false; I had to keep as true. it worked as expected.

[@Nick.Anselmo]

Feel like you made this for me...lol Thanks Adam!

[@AlbertoGastaldo]

Hi Adam. I am using embedded with a tabular model that resides on SSAS on -prem. In such scenario, , I had to pass CUSTOMDATA instead of USERNAME in the code. The reason is that - once the USERNAME is passed via gateway to my on-prem SSAS, it must be validated against the domain and must correspond to an existing AD user. So If I need to pass the logged-in user in my web-app, the connection would fail. Using CUSTOMDATA, I can pass any string in the connection. Authentication to SSAS is done using the domain user the gateway is running under. Finally, I get information from CUSTOMDATA in my RLS code and do all the DAX magic there. In your opinion, is this a valid and correct scenario ?

[@GuyInACube]

Yup using CUSTOMDATA with Power BI Embedded is supported. There is a section for CUSTOMDATA in this doc - docs.microsoft.com/power-bi/developer/embedded/embedded-row-level-security#working-with-analysis-services-live-connections

[@juliennevers9943]

@@GuyInACube Can you confirm you can use CUSTOMDATA with SSAS on prem because Microsoft Doc indicates CUSOTMDATA can be used only with Azure analysis services but not SSAS on prem

[@trantrongnghiaw]

same question@@juliennevers9943

[@antonzhong9970]

Cool video, Adam (as always), one question, is this embed style works in Dynamics 365 F&O embed workspace as well ? Thanks

[@PhilcoCup]

I'm looking for a way to embed with Role security but on Salesforce

[@046_adityamishra6]

Hey did you find the solution to this? I'm embedding a power bi report in D365 F&O, will this method work and if not what will the work around? Please reply.

[@cornemouton2740]

Thank you, you helped me a great deal, appreciated. Great and informative video. PS: I was assuming roles (on EffectiveIdentity) could be null or even have an empty role but that kept giving me Bad Request :s

[@christout]

Thanks for the video - however, it doesn't answer the question I have. Say you have a list of users in Auth0 - how would I re-use the token Auth0 issues to pass into Power BI Embedded to show that user the appropriate content?

[@rob_trevino]

did you ever get an answer to this?

[@christout]

@@rob_trevino no, but I am more convinced it's possible now than I was 8 months ago. I have gotten this working with Azure AD members, based on their access within an Azure app and passing that access through.

[@cedtebann]

Hi, I see you can do RLS security in BI Embedded. What about Object Level Security in Embedded Power BI?

[@vinaypugalia6627]

Amazing Video Adam! While generating tokens for PBI Embedded using PBI JavaScript library, how to secure the Master User Credentials? I mean if we hardcode them in Javascript, they are not secured. Please guide.

[@GuyInACube]

So, you don't generate the Embed Token with the JavaScript Library, you do that from the .NET SDK, or direct REST API call, from the back end. NEVER use the master use credential from the JavaScript side - that is NOT secure.

[@vinaypugalia6627]

@@GuyInACube Thanks a lot for the insight Adam. However, if we do a direct REST API call from Javascript, won't we need to pass the credentials from Javascript itself? Please clarify.

[@visheshjjain]

Does RLS embedded work with multiple IDs? If yes, how? Thanks!

[@AlbertoGastaldo]

Vishesh Jain what do you mean by multiple id’s?

[@stevenewton7230]

I saw this video and thought hurray after 2 days.... exactly what I am looking for. I have tried and failed to use your project or in mine changing the MS demo, to use the API for RLS embedded reports. It works perfectly in all of them for non-RLS on the same report. With RLS, it generates an error on the token generation, Microsoft.Rest.HttpOperationException: Operation returned an invalid status code 'BadRequest'. I am clearly missing something fundamental in my setup, but I have no idea what it is. The fact that non-rls works, hopefully it a clue?? Anyone?

[@stevenewton7230]

OK I have found the issue. whilst the code responds with Bad Request which isn't helpful. The underlying API responds with something far more helpful, which I needed Fiddler to see. The report I selected did not have RLS enabled, as I made the change locally not on the server. It doesn't like that, which is why it worked one way but not the other. It would be great if 1. MS included this code in their examples rather than ignore RLS on their GIT examples and 2. lets have some helpful error messages when the API itself provides them. Bad Request, is as helpful as Object is not set to an...............

[@QJ4ck]

I am at the exact same spot here. Have you solved this issue? Do you need capacity license for rls?

[@stevenewton7230]

@@QJ4ck you don't need capacity license. Lots of docks suggest you do. This was a long time ago so my brain is a little foggy.

[@stevenewton7230]

​@@QJ4ck I broker out the process, as in my application one area sees everything and the other area sees a restricted view via RLS. I can't where it was but in the code here where it checks if its RLS, this was the issue for me, I split it out as my use case worked for that. So not logic to check if it was RLS or not and do something different. I just did one code path for RLS and one for not. If you create a role list and your report doesn't have any (or vice versa) I think I got that error. Sorry can't be more specific.

[@HARSHALK-s6m]

@@stevenewton7230 Can you please provide your mail id, I have to implement RLS in the embedded report?

[@hamidansari9441]

when i change "Viewing as " someone else, i don't see any change , still powerbi shows my account as viewer!

[@ReviewGurl]

How did you solve it.. I have same error

[@AliAbbas-ik9ix]

Excellent

[@marciof]

I hate the limit of the embedded tokens.

[@ShubhamYadav-ql9ov]

But I have searched for "Rocket league Sideswipe" (RLS).........😂😂