Power BI embedded RLS using the PowerBI service

[RvP_NL]

Reading this post about a different implementation of embedding Power BI, I'm curious if and if so how RLS is implemented. I can't seem to find any reference to this.

[v-huizhn-msft]

Hi @RvP_NL,

The Power BI Embedded doesn't depend on the Azure AD account or windows account. That is, you can freely determine "which user uses what roles" in your app.

After your app authenticate the user, your app should determine what role is needed, and use the following json/PHP/.Net(it depends on your custom app) string as the input of access token signature. For example, add the RSL(highlighted in bold) in json string:

{
"wid":"{workspace id}",
"rid":"{report id}",
"wcn":"{workspace collection name}",
"iss":"PowerBISDK",
"ver":"0.2.0",
"aud":"https://analysis.windows.net/powerbi/api",
"nbf":{start time of token expiration},
"exp":{end time of token expiration},
"roles":"{role names (multiple) delimited by comma}",
"username":"{user name}"
}

After getting RLS with Power Bi embedded, you can use it according to the article you posted.

More details, please review the following references.

Works with Row Level Security in Power BI and Power BI Embedded
Row level security with Power BI Embedded
How to use Power BI Embedded via REST

Best Regards,
Angelia

[RvP_NL]

Hi @v-huizhn-msft,

Thanks for your reply. The links you're refering to concern embedding PowerBI using Azure. My question is about RLS in Embedded PowerBI; not using Azure to store the reports/datasets but using app.powerbi.com service. 

Or are you suggesting this works exactly the same regarding RLS?

thanks again!