Overview
When using our Power BI widget with Service Principal authentication, you may be asked to provide identity information depending on how your report or dataset is configured in Power BI.
This guide explains:
When identities are required
What information you need to provide
How to interpret the status messages shown in the widget
Where to find more information from Microsoft if needed
What Are Identities and Why Are They Needed?
Power BI supports Row-Level Security (RLS) and user impersonation to restrict or personalize data.
When using a service principal to access and display content, Power BI sometimes requires you to specify which “user” you’re acting on behalf of, especially when:
RLS is applied to a dataset
The report uses live data connections that impersonate users (e.g., DirectQuery, SSAS)
The application serves multiple end-users with different data access levels
This is done by passing what Power BI calls an EffectiveIdentity, which includes a username, roles (if any), and optionally dataset IDs.
Color Indicators in the Widget
After you provide a Power BI report or dashboard URL, the widget will display a status color:
Green – No Action Required
Your content is accessible with the service principal as-is.
You do not need to fill in any identity fields.
Yellow – Identity Required
The content is protected by security configurations that require user impersonation.
To display it correctly, you’ll need to fill in identity fields.
Red – Invalid or Inaccessible
The URL is incorrect or your service principal does not have access to the content.
Please verify that:
The URL points to a valid Power BI report or dashboard
The service principal has access to the workspace and dataset
When Are Identities Required?
Scenario | Are Identities required? | Required Fields |
Dataset with Row-Level Security (RLS) | Yes |
|
Report using DirectQuery or Live Connection with impersonation | Yes |
|
Report connected to SQL Server Analysis Services (SSAS) | Yes |
|
Report for multi-tenant use (serving multiple users) | Yes |
|
Dataset is import-only, with no RLS or impersonation | No | - |
Service principal has full access and no RLS is defined | No | - |
What to Provide
When the system shows a yellow status, you’ll need to fill in the following fields:
Username
The user you're impersonating. This is typically an email address (UPN), e.g.[email protected]Roles
If your dataset uses RLS, provide the exact names of the roles defined in Power BI, e.g.["Manager"]Datasets
Required only in certain configurations (e.g., when a dataset from another workspace is used). This is the dataset’s GUID and can often be found in the report URL.
Example
Let’s say your dataset has RLS and you want to show the report as user John Doe, who belongs to the "Manager" role.
You would fill in the form like this:
Username:
[email protected]Roles:
ManagerDatasets:
8874b05c-115c-44b4-8c08-bcc925f902a2
💡 If your dataset doesn’t use roles, you can leave the “Roles” field empty.
How to Check If RLS Is Used
To verify whether a dataset in Power BI uses Row-Level Security:
Go to the Power BI Service
Locate the relevant dataset
Click on Security
If you see roles listed there → RLS is active
You can ask the report owner or your Power BI administrator if you're unsure.
Common Signs You Need Identities
You’ve received a yellow warning in the widget
You know the report is using RLS or pulling live data
You expect the content to show different data for different users
You see access-related errors when previewing the widget
Further Reading (Microsoft Docs)
For more technical details and reference, you can review the following official Microsoft documentation: