How to embed Power BI
into Embedportal.

Why this is needed

To embed Power BI reports and dashboards you need to register an application in Azure Active Directory. This lets Embedportal authenticate with Power BI on your behalf using a service principal, so reports embed securely while your data stays in your Power BI workspace.

works with — Power BI Service (Azure AD integrated).

Prerequisites

• An active Power BI Service tenant with the reports you want to embed.
• Azure AD admin access (to create an App Registration and grant admin consent).
• Power BI admin access (to change tenant settings).
• Workspace admin access for the workspace containing the reports.
• An Embedportal workspace (Professional or Enterprise plan).
• About 30 minutes end-to-end.

Register a New Application

1. Open Azure AD App Registrations.
2. Click New registration. Name the app atSpark Power BI Integration — this is the name Embedportal expects.
3. Supported account types: Accounts in this organizational directory only (single tenant).
4. Click Register. Leave the redirect URI blank — service-principal embedding doesn’t need one.

Copy Application Identifiers

From the app’s Overview page in Azure AD, copy two values:

Both are GUIDs. They’re safe to copy at any time.

Create a Client Secret

1. In the Azure AD App, go to Certificates & secrets → Client secrets.
2. Click New client secret. Description: atSpark Integration. Expiry: 24 months (recommended — longer is lazier, shorter is fiddlier).
3. Azure shows two columns: Secret ID and Value. Copy the Value — that’s what goes into Embedportal’s Client Secret field.

important — the Value is only shown once. Save it immediately.

Configure API Permissions

Embedportal needs read access to reports, dashboards, and datasets in your Power BI tenant.

1. In the Azure AD app, open API permissions → Add a permission → Power BI Service. Select Delegated permissions.
2. Select three scopes:
   • Report.Read.All
   • Dashboard.Read.All
   • Dataset.Read.All
3. Click Add permissions.
4. Click Grant admin consent for [Your Organization] → Yes. This has to be done by an Azure AD admin.

Enable Service Principal in Power BI Admin Portal

Power BI rejects service-principal requests by default. A Power BI admin has to explicitly turn it on for your tenant and allowlist your app.

1. Go to the Power BI Admin Portal → Tenant settings.
2. Under Developer settings, enable:
   • Allow service principals to use Power BI APIs — add your app by Application ID.
   • Allow service principals to use read-only admin APIs — nice to have.
3. Click Apply.

you must be a Power BI Admin to access Tenant settings.

Add Service Principal to Workspace

Finally, grant the service principal access to the workspace that holds the reports you want to embed.

1. In Power BI, open the workspace containing the reports.
2. Click Access → Add people. Search for your app name atSpark Power BI Integration.
3. Grant Viewer (enough for embedding) or Member (only if Embedportal should create or modify content on your behalf).

Fields you’ll fill in Embedportal

The Power BI connection form collects three values:

Click Save & Test Connection. Embedportal will call the Power BI REST API, fetch your workspace list, and show a green confirmation. You’re connected.

Row-level security

Define RLS roles in your Power BI dataset (Power BI Desktop or the service), then turn on RLS for the dashboard in Embedportal. Embedportal forwards the viewer’s tenant, region, role or custom attributes as Effective Identities on the embed token, and Power BI applies the matching role at query time.

For the full setup across vendors, see: Row-level security for embedded dashboards.

Security best practices

• Rotate the client secret every 24 months at minimum.
• Grant the service principal Viewer on the workspace, not Member, unless you need write access.
• Do not grant the app broader Microsoft Graph permissions — only Power BI Service scopes.
• Monitor service-principal usage in Azure AD audit logs and Power BI activity logs.
• If the Client Secret leaks, delete it in Azure AD and create a new one; Embedportal can be updated in under a minute.

Troubleshooting

• 401 unauthorized — Client Secret doesn’t match. Check you copied the Value, not the Secret ID.
• 403 forbidden — service principals aren’t enabled in Power BI Tenant settings, or your app isn’t on the allowlist.
• Workspace list is empty — the service principal hasn’t been added to any workspace. Add it as Viewer.
• Report loads blank — the dataset is using a personal connection; change it to a gateway or import to make it accessible via the service principal.
• “This report is embedded but you don’t have access” — the service principal needs workspace access, but for datasets it may also need Build permissions explicitly.
• Admin consent fails — you need to be an Azure AD Global Admin or Privileged Role Admin to grant tenant-wide consent.