Showing report on website with RLS without using microsoft authentication

[debiesven]

Hi,

We are currently creating generic reports for internal AND external use. The difference between between internal vs. external is that internally we can see all records and externally our customers can only see the records that are theirs (RLS). So the same report and depending per role they see all data (internal) or RLS is applied (external).

Current situation:

We receive the e-mail address of the customer who wants to see the report. We create a guest account for this user in our tenant and assign the user to the ExampleCustomer group (customers user group for which RLS will be applied). We have a mapping table with the e-mail address of the customer and what he's allowed to see. We have given view access to the FabCustomer group for the generic PowerBI report report. So they can automatically access the report from the moment they have accepted their guest invitation. The data source of our report is AAS with the RLS enabled for ExampleCustomer group en without RLS for ExampleEmployee group.

We want to have all customers on this and share our insights with them. We are talking about more than 10k customers (with at least 1 viewer of the report). We are going to move to capacity instead of per user license, because of the number of customers.

We already have a website where customers can login to and where we want to show the reports in. But without the microsoft authentication on the report for better usability. From a customer perspective it doesn't make sense that he needs to login twice on the same portal with different login credentials (webshop and Microsoft).

But if I look at the documentation then RLS is possible only when loggin in with your Microsoft account, but we already have an authentication layer in our webshop. But I can't seem to find a way how to show a report with RLS in our webshop without the need of loggin in with a Microsoft account.

I have been thinking/searching for multiple directions:

• Publish to web (then it's public) and then apply filtering, but that's not secure enough and can be changed by a user.  We can hide all information in the report if the filter isn't set for example. And then work with a secret hash that is shared between the webshop and the report and only view info based on that hash. https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-publish-to-web
• Embed a secured report (so RLS can be applied), but then it needs a Microsoft account for authentication https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-embed-secure
• Via API's, but it doesn't state anything about RLS etc. https://docs.microsoft.com/en-us/power-bi/developer/embedded/embed-sample-for-customers?tabs=java

Any ideas for next steps or direction?

[GilbertQ]

Hi @debiesven 

There is a limitation with Publish to Web that will not work with RLS.

Your only option is to embed your Power BI reports within your own application, and from your application you then pass through the required RLS details to the Power BI Dataset. Doing it in this way the user will only have to log into your application. Your application will then handle the RLS under the hoods.

[debiesven]

Again thank you for your answers. It already helped us, I have an additional question though. Is it correct when I do the assumption that when we connect our PowerBI reports to AAS that we probably can always use the PowerBI Embedded A1 (cheapest) as most of the computing will be done on AAS part and only visualization computing will be done by PowerBI Embedded?

[debiesven]

Thanks @GilbertQ for your quick answer. What is the application in your reply? Is that our website or is that an app in Powerbi? 

[GilbertQ · Accepted solution]

hi @debiesven 

Here are more details: Power BI in Your Apps | Microsoft Power BI