Secure Multi-Tenant Embedded Analytics: Streamline Power BI Workflows with Row-Level Security

How to Simplify Secure Multi-Tenant Analytics Using Power BI Embedded (No More Costly Data Leaks!)

Why ISVs Struggle with Embedded Analytics

If you're building a SaaS app that serves multiple customers (tenants), you’ve probably faced these two headaches:

• 🛠️ Embedding Takes Forever: Manually integrating Power BI reports into your app can take weeks of coding, especially if you need to handle user permissions.
• 🔐 Data Security Nightmares: Accidentally showing Tenant A’s data to Tenant B isn’t just embarrassing—it can lead to lawsuits or failed compliance audits.

Real-World Example: A healthcare startup built a patient analytics dashboard for hospitals. They spent 6 months writing custom code to filter data by tenant. But one misplaced SQL query exposed sensitive patient records across hospitals. The result? A $50,000 compliance fine and angry customers.

The Solution: Let Power BI Handle Security (Not Your Code)

Instead of building security from scratch, use Power BI’s built-in row-level security (RLS). Here’s how:

Step 1: Connect Your App to Azure Active Directory

Azure AD helps identify users and their tenant. This code sets up authentication in a .NET app:

// Startup.cs in your ASP.NET Core app
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));
// This automatically checks the user’s tenant ID

Why this matters: Azure AD acts like a bouncer—it verifies who the user is and which tenant they belong to.

Step 2: Embed Reports in 10 Lines of Code

Use Power BI’s .NET SDK to generate secure tokens (no manual API calls!):

// Generate an embed token for the logged-in user
var embedParams = new GenerateTokenRequest(
    accessLevel: "View", // Restrict editing
    datasetId: "d1234-abcd-..." // Your Power BI dataset
);
var embedToken = await pbiClient.EmbedToken.GenerateTokenAsync(embedParams);
// Pass this token to your frontend to load the report

Step 3: Auto-Filter Data by Tenant (No Code)

In Power BI Desktop, create a Row-Level Security role that filters data using the user’s email or tenant ID:

[TenantID] = USERNAME() 
// If USERNAME() is "user@tenant1.com", 
// only Tenant1’s data appears

Pro Tip: Map Azure AD’s tenant_id claim to Power BI’s USERNAME() for automatic filtering.

Step 4: Assign Users to Roles Automatically

Use PowerShell to assign users to RLS roles when they sign up:

# Assign user@tenant1.com to "TenantAdmin" role
Invoke-PowerBIRestMethod -Url "groups/$WorkspaceId/datasets/$DatasetId/users" -Method Post -Body '{
  "identifier": "user@tenant1.com",
  "role": "TenantAdmin"
}'

How It All Works Together

High level Architecture

Key Takeaway: Power BI enforces data filters at the visualization layer, so even if your app code has bugs, tenants can’t see each other’s data.

Real Results from This Approach

✅ Development Time: Reduced from 6 months to 2 weeks

✅ Security: Zero data leaks in 2 years post-implementation

✅ Maintenance: Changed tenant filters in 1 hour (vs. 3 days previously)

Common Mistakes to Avoid

• ❌ Hardcoding tenant IDs in DAX formulas (use dynamic claims instead)
• ❌ Giving users “Admin” access in Power BI workspaces
• ❌ Using app-level filters without RLS as backup

Next Steps

1. Learn More: Microsoft’s RLS Guide | Embedding Tutorial

2. Share Your Story: Have you tried Power BI embedding? What worked (or didn’t)? Let’s discuss below! 👇