Power BI Embedded, Generate Embed Token only with View Access

Question

I have embedded the power bi report using service principal as given here.

I'm generating the embed token as below,

var generateTokenRequestParameters = new GenerateTokenRequest(accessLevel:"View",allowSaveAs:false,identities: new EffectiveIdentity[] { new EffectiveIdentity(username: serviceAccount, roles: new string[] { "Viewer" }, datasets: new string[] { report.DatasetId }) });
EmbedToken embedToken = client.Reports.GenerateTokenInGroup(groupId, reportId, generateTokenRequestParameters);

But when I embed the report using javascript sdk, if I configure the permission as below the user able to edit the reports. How can prevent the user from editing the report in the embed token?

permissions: models.Permissions.ReadWrite,
viewMode: models.ViewMode.Edit,

vvvv4d vvvv4d · Accepted Answer · 2019-05-22T20:05:48

I have a C# MVC Web Application which embeds PowerBI reports.

Here is our embed config

var config = {
        type: 'report',
        id: embedReportId,
        accessToken: accessToken,
        tokenType: models.TokenType.Embed,
        embedUrl: embedUrl,
        permissions: models.Permissions.View,
        settings: {
            filterPaneEnabled: false,
            navContentPaneEnabled: true,
            background: models.BackgroundType.Transparent,
            layoutType: models.LayoutType.Custom,
            customLayout: {
                displayOption: models.DisplayOption.FitToWidth
            }
        }
    };

You mentioned the viewMode property in your question. As you can see we do not even set the viewMode property in our config. We only set the permissions property but as far as I can tell it doesn't do much. This property is rarely used or only controls minor things you can see on the UI.

If you generate the access token like you are for "View" and someone edits the embedding report viewer page to change the permission property from models.Permissions.View to models.Permissions.ReadWrite in the HTML/javascript any subequent calls the PowerBI JavaScript library attempts to make after that report viewer page edit would fail because the accesss token that was generated is for View and not Edit and the API calls to Microsoft/PowerBI would fail.

So you really just need to make sure your back end logic is generating the correct access token for whatever the viewing context is. If you were generating an access token with full permissions and using the PowerBI javascript library to hide things then users could potentially alter your page source and do more than you wanted.

Good luck

Power BI Embedded, Generate Embed Token only with View Access

1 Answers