Power BI Embedded Analytics: Complete Guide for ISVs and Enterprise Applications
A production-grade guide to Power BI Embedded for ISV product managers, CTOs, and enterprise architects—covering SKU selection, JavaScript SDK, authentication, row-level security, multi-tenancy, and cost optimization.
Power BI Embedded is the mechanism by which thousands of ISVs and enterprise development teams deliver analytics inside their own applications—without requiring end users to hold Power BI licenses or ever visit app.powerbi.com. Done correctly, embedded analytics becomes a competitive differentiator: your customers see your brand, your product navigation, and your data—not Microsoft's. Done incorrectly, it produces slow reports, broken row-level security, unpredictable Azure bills, and support tickets from customers who cannot see their own data. Our Power BI consulting team has deployed embedded analytics across healthcare, financial services, and SaaS platforms at enterprise scale.
Embed for Your Organization vs. Embed for Your Customers
The single most consequential architectural decision is choosing between two embedding scenarios.
Embed for Your Organization (User Owns Data) End users authenticate with their own Azure AD identities. The application acquires an access token on behalf of the signed-in user. The user must hold a Power BI Pro or PPU license. Reports render with that user's existing permissions automatically.
When to choose: Internal enterprise apps, portals with AAD authentication, intranet dashboards where all viewers are employees with M365 licenses.
Embed for Your Customers (App Owns Data) Your application holds a service principal with Power BI access. Your backend generates embed tokens scoped to specific reports and RLS identities. End users are anonymous to Microsoft—they authenticate against your application identity system. No Power BI licenses needed for viewers.
**When to choose:** SaaS products, multi-tenant applications, white-label analytics, any scenario where per-user licensing is impractical. Our Power BI architecture practice designs the full embedding topology before the first line of JavaScript is written.
| Dimension | Embed for Org | Embed for Customers | |---|---|---| | End user identity | Azure AD user | None (app handles auth) | | Token type | AAD access token | Embed token (GenerateToken API) | | License per viewer | Pro or PPU | No (covered by capacity) | | RLS enforcement | Automatic | Explicit (roles in token) | | Ideal for | Internal apps | ISV products, external portals |
SKU Selection: A-SKU vs P-SKU Capacity
A-SKU (Azure Power BI Embedded) Provisioned in Azure portal, billed hourly, pausable. Designed for App Owns Data embedding. A3 (4 v-cores) handles approximately 100 concurrent report loads. A4 (8 v-cores) handles approximately 250. Pausing during off-hours saves 30-40% for B2B SaaS applications.
P-SKU (Power BI Premium) Monthly flat rate via Microsoft licensing. Includes Premium features beyond embedding—XMLA write, large datasets, Fabric integration, paginated reports. Cannot be paused. P1 starts at approximately $4,995/month.
**Choose A-SKU when:** Embedding is the primary need, workloads have on/off patterns, you want Azure consumption billing. **Choose P-SKU when:** You need Premium features beyond embedding, usage is consistent 24/7, you are already an EA customer. Our Power BI architecture services include SKU sizing based on concurrent user load, dataset size, and refresh frequency.
JavaScript SDK Integration and React Components
The Power BI JavaScript SDK (powerbi-client) renders interactive reports inside your application. Install the client library and React wrapper: powerbi-client and powerbi-client-react via npm. The PowerBIEmbed React component manages the SDK lifecycle.
Key implementation rules: - Never expose service principal credentials in browser-side code. Embed token requests must originate from your backend API. - Embed tokens expire (default 1 hour). Implement token refresh using the SDK setAccessToken method before expiry. - Wire report load events (loaded, rendered, error) to your observability stack. - Mobile layouts require the MobilePortrait layout type or a responsive custom layout.
Authentication Patterns: For User Owns Data, use MSAL to acquire tokens on behalf of the signed-in user with the Power BI API scope. For App Owns Data, your backend calls the GenerateToken REST API using a service principal AAD token. Always use a service principal rather than a master user account—service principals support certificate-based rotation and are not tied to an individual employee account.
Our dashboard development team builds production React component libraries with token refresh, error boundaries, skeleton loaders, and telemetry.
Row-Level Security in Embedded Applications
RLS is the mechanism that ensures Customer A users cannot see Customer B data when multiple tenants share the same embedded report. In App Owns Data, RLS is the primary data isolation control.
Define RLS roles in Power BI Desktop using DAX filter expressions. A common multi-tenant pattern filters a TenantID column using USERNAME(), which in embedded context returns the username field from the embed token identity. When you call GenerateToken and pass a specific username, Power BI substitutes that value into the DAX expression, filtering the dataset to that tenant rows. The filter propagates through all relationships.
Critical testing requirement: Always test RLS using View as Role in Power BI Desktop before deploying. Verify with the Effective Identity API in staging that simulates each tenant access pattern.
Multi-Tenancy Patterns and White-Labeling
Multi-Tenancy Architecture Options
Single workspace, shared dataset with RLS (lowest cost): All tenants data in one dataset, RLS filters per tenant. Risk: a DAX error in RLS could expose cross-tenant data.
One workspace per tenant (maximum isolation): Each customer gets dedicated workspace with their own dataset. Requires workspace automation via REST API. Use for regulated industries where data co-mingling is a compliance risk.
Workspace per customer tier (balanced): Customers grouped into pools by tier, RLS provides isolation within pools. Most common pattern for mid-market SaaS with 100-10,000 customers.
White-Labeling Apply your brand design system as a Power BI JSON theme controlling colors, fonts, backgrounds, and visual defaults. The SDK settings hide Power BI chrome elements. Apply themes programmatically via the SDK applyTheme method to match each tenant branding without reloading.
Performance and Cost Optimization at Scale
**Semantic model optimization:** Use Direct Lake (Microsoft Fabric) or import mode for maximum query performance. Create aggregate tables for common granularities. Disable auto date/time tables to reduce model size.
Capacity planning: Monitor the Premium Capacity Metrics app for CPU throttling, memory pressure, and query queue depth. Use read-only replicas to scale read workloads horizontally.
Cost optimization patterns: - Pause A-SKU during off-hours (automate with Azure Automation) for approximately 67% savings on 8-hour workday usage - Right-size continuously when average CPU utilization is below 40% - Consolidate reports sharing datasets onto fewer workspaces to reduce redundant loads - Batch paginated report exports during low-usage windows - Use Power BI Activity Log API for per-tenant cost allocation and COGS reporting
Ready to build or optimize your embedded analytics? Contact our Power BI Embedded specialists for an architecture review and implementation roadmap tailored to your ISV or enterprise application.
Frequently Asked Questions
What is the difference between Power BI Embedded A-SKU and P-SKU?
A-SKUs are Azure resources billed hourly that can be paused when not in use, designed specifically for the App Owns Data embedding scenario. P-SKUs are monthly flat-rate licenses that include Premium features beyond embedding. ISVs should start with A-SKU for the cost savings from pausing; organizations needing Premium features should use P-SKU.
How do I prevent one customer from seeing another customer data in shared embedded reports?
Row-level security (RLS) with a DAX filter role using USERNAME() is the primary control. Your backend passes the customer identifier in the GenerateToken API call. Power BI substitutes that value into the DAX filter expression, scoping all data to that customer. For regulated industries, use one-workspace-per-tenant for physical data isolation.
Can I remove Microsoft branding from embedded Power BI reports?
Yes. Apply a custom JSON theme for your brand colors and fonts. The SDK settings allow hiding the title bar, filter pane, page navigation, and toolbar. Replace those with your own UI components that call SDK navigation and filter APIs. The result looks and behaves as a native part of your application.
How many concurrent users can a Power BI Embedded capacity support?
An A3 (4 v-cores) supports approximately 100 concurrent report loads, A4 (8 v-cores) approximately 250, and A5 (16 v-cores) approximately 500+, depending on report complexity and dataset size. Load test with realistic concurrent sessions before go-live and monitor CPU and memory in the Capacity Metrics app.