Setting up Power BI Embedded in Power Pages gives external users live dashboards without sending spreadsheets. Furthermore, external viewers do not need individual Power BI licences. However, the hardest part is ensuring each person sees only their own data. Fortunately, Power Pages supports this requirement through Power BI Embedded and row-level security (RLS). Consequently, when you configure it properly, one report can serve every role. Therefore, this guide walks through how we built it, the vital settings, and how we tidied the user experience.

First, the Power Pages Power BI component offers three access types. However, only one option suits external users viewing private data:

In short, Microsoft's documentation clearly states that only Power BI Embedded supports RLS. Therefore, for a secure customer portal, the choice is already made for you.

From sign-in to filtered report in five steps.

Step 1: Model the Data Around the Contact

First, RLS needs a clear path from the signed-in Contact to their specific rows. For instance, your portal's table permissions might already use Account access and Contact lookups (covered in Part 1). In that case, that exact path already exists. Consequently, designing your portal security and reporting security together saves massive rework later.

Step 2: Create Roles Named Exactly Like Your Web Roles

Next, open Power BI Desktop and create one RLS role per portal web role. Importantly, you must use the exact same role names. Specifically, each role's DAX filter matches the Contact's portal username to the identity passed by Power Pages. For example, Microsoft's guidance uses this formula:

Here, [User Name] is the Contact column holding the portal identity, rather than an email address. Instead, we used USERPRINCIPALNAME(), which returns the identical value for an embedded identity. Afterwards, each role filters onwards to the right data scope. For example, a Client Administrator sees the whole company, while a Site Manager sees their sites. Similarly, a Contractor Engineer sees only their own assigned jobs.

Step 3: Pass the Roles From the Portal

Finally, turn on Apply roles on the Power BI component, or pass them in the Liquid tag. Specifically, Microsoft's documentation shows a neat trick for dynamically passing the signed-in user's web roles:

By default, an embedded report displays the filter pane and bottom page tabs. However, you cannot hide either element with CSS because they sit inside the Power BI iframe. Instead, the Microsoft-supported method uses the powerbi-client JavaScript API inside the page's custom JavaScript:

Keep two important points in mind here. First, never mix this script with the older navContentPaneEnabled and filterPaneEnabled settings. Second, if you hide the page tabs, check your report canvas carefully. Specifically, space previously covered by the tab bar may now show underlying content. Fortunately, you can fix this easily in Power BI Desktop and use in-report buttons for navigation.

• First, use "Embed for your customers" (Power BI Embedded), as it is the only option supporting RLS for external users.
• Second, name your RLS roles identically to your web roles and pass them dynamically from the page.
• Third, design your portal permissions and report security together around the Contact record.
• Fourth, hide panes using the JavaScript API, and remember that visual hiding is purely cosmetic.
• Finally, plan ahead for capacity costs, workspace separation, and environment-specific report paths.

Last checked against Microsoft Learn guidance: November 2026.