How to Use Power BI Embedded

Embedding professional, interactive analytics directly into your own application might seem like a complex task reserved for enterprise software companies, but Power BI Embedded makes it surprisingly accessible. This process allows you to provide a seamless data experience for your customers, right inside your product or portal. This article walks you through exactly what Power BI Embedded is and how to get your first report up and running within your app.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What is Power BI Embedded?

Power BI Embedded is an Azure service that lets developers integrate Power BI reports and dashboards into their own web applications or portals for people outside their organization - namely, their customers. In short, you're placing your Power BI content within your own product under your own brand, and your end-users don't even need a Power BI license to view or interact with it.

This is different from simply sharing a Power BI report link from the Power BI service. The standard Power BI service is designed for internal business intelligence, where every user has their own license. Power BI Embedded is specifically for a "Platform-as-a-Service" (PaaS) scenario where you, the application provider, manage the analytics experience and authentication for your users.

Imagine you run a SaaS application for project management. With Power BI Embedded, you could build an analytics dashboard showing project timelines, budget burn-down, and resource allocation, and then embed that dashboard directly into your app's user interface. Your customers could interact with the data - filtering by project, date, or team member - without ever knowing they're using Power BI.

"Embed for your customers" vs. "Embed for your organization"

One of the most confusing parts of the embedding landscape is the terminology. Power BI offers two primary embedding models, and choosing the right one is critical.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Embed for your customers

This is the model that uses the Power BI Embedded Azure service. It's designed for Independent Software Vendors (ISVs) or any company building an application for external users. The key features are:

• Your end-users do not need a Power BI license.
• Authentication is handled by your application, usually through a "service principal" in Azure Active Directory (Azure AD). This means your app logs into Power BI on behalf of the user.
• You pay for dedicated rendering capacity through an Azure subscription (Power BI Embedded A SKUs, e.g., A1, A2). You aren't paying per user.
• This is the true "white-label" analytics solution.

This model will be the main focus of our guide.

Embed for your organization

This model is for serving internal team members through a company portal, SharePoint, or Microsoft Teams. Key features include:

• Your end-users must have a Power BI Pro or Premium Per User (PPU) license.
• Authentication is handled by the user themselves logging into their organizational Microsoft account.
• There is no separate Azure capacity to buy, you're using your regular business Power BI licenses.

While useful for internal portals, this isn't what people typically mean when they refer to building customer-facing analytics with Power BI Embedded.

Key Components Needed for Power BI Embedded

To use the "embed for your customers" model, you need a few key pieces working together. Think of it like a recipe - you need all the ingredients before you can start.

• A Power BI Pro License: One person, often the lead developer or admin, needs a Pro license. This "master account" is used to create and manage the reports inside the Power BI service before they are embedded.
• A Power BI App Workspace: This is a dedicated container inside the Power BI service where you'll store the reports, dashboards, and datasets you plan to embed.
• An Azure AD App Registration (Service Principal): You need to register your application in Azure AD. This creates a non-human identity that your backend can use to securely authenticate to the Power BI APIs without using a master user's password. This is the recommended and most secure method.
• Power BI Embedded Capacity: This is an Azure resource you purchase. It gives you dedicated resources for rendering your reports for your customers. You pay for this resource hourly, and you can scale it up, down, or even pause it to save costs when nobody is using your app.
• Your Custom Application: The destination for your reports! This is the web app or portal you've built, which will include code to handle authentication and render the embedded content.

Step-by-Step Guide to Setting Up Power BI Embedded

Ready to get started? The setup process involves steps in both the Power BI Service and the Azure Portal. Follow these steps carefully to ensure everything is configured correctly.

Step 1: Get Your Prerequisites in Order

Before you begin, make sure you have an Azure subscription with an active account and a Power BI Pro user account. Your company is likely already on a Microsoft 365 plan that includes these.

Step 2: Create a Power BI Workspace

First, log into the Power BI Service (app.powerbi.com) with your Pro account. Workspaces are where your content lives.

• In the left navigation pane, click Workspaces > Create a workspace.
• Give it a unique name (e.g., "SaaS App Analytics").
• Open the Advanced section and ensure you have selected either Pro or Premium Per User for the license mode. This allows you to publish from Power BI Desktop.

Step 3: Register an Azure AD Application (Service Principal)

Now, let’s create the identity for your application so it can communicate with Power BI.

1. Navigate to the Azure portal (portal.azure.com).
2. Search for and select Azure Active Directory.
3. Under Manage, select App registrations > New registration.
4. Give your app a clear name, like "MyDataApp," and leave the other settings as their default. Click Register.
5. Once created, you'll be on the app's overview page. Copy the Application (client) ID and Directory (tenant) ID. You'll need these later for your application's code.
6. Next, go to Certificates & secrets, click New client secret. Give it a description, set a duration, and click Add. Immediately copy the "Value" - this is your app's password and it disappears once you leave the page. Store it securely.

Step 4: Create a Security Group and Put Your App in It

Power BI requires service principals to be part of a security group to access its APIs. This is a recent security enhancement.

1. Back in Azure Active Directory, go to Groups > New group.
2. Set the Group type to Security.
3. Give the group a name, like "PowerBI_Embedded_Apps." Click Create.
4. Open your newly created group, go to Members > Add members.
5. Search for the app you registered in the previous step and select it.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Step 5: Enable Service Principal Access in Power BI

You now need to tell Power BI to allow access from the app you just created.

1. Go to the Power BI Admin portal (app.powerbi.com/admin-portal).
2. Go to Tenant settings and scroll down to Developer settings.
3. Expand the setting called Allow service principals to use Power BI APIs.
4. Enable it and select Specific security groups. Search for and add the security group you created in Step 4.
5. Click Apply. It might take about 15 minutes for the changes to take effect.

Step 6: Grant Workspace Access to the Service Principal

Your app now has permission to talk to Power BI, but it doesn't have access to your specific workspace content yet.

1. In the Power BI service, go back to the workspace you created in Step 2.
2. Click the Access button in the top right.
3. Search for the name of your registered application (e.g., "MyDataApp").
4. Assign it the Admin role within the workspace. This allows it to publish content and get embed tokens.

Step 7: Purchase Power BI Embedded Capacity

This is where you dedicate the rendering engine.

1. In the Azure portal, click Create a resource and search for Power BI Embedded.
2. Click Create.
3. Select your subscription and resource group. Choose a capacity name and location. For the Power BI Capacity Administrator, select your master user account.
4. Choose your SKU. The A1 SKU is a great starting point for development and small-scale applications. You can pause this resource to avoid charges.
5. Once deployed, navigate back to the Power BI Admin portal > Capacity settings. You should see your new capacity. Assign your workspace to this new capacity.

Step 8: Publish and Embed Your Report

Now for the fun part! Build a simple report in Power BI Desktop and publish it to the workspace you configured above. Once it's published, you can move to your application's code.

Your backend code will need to perform two authentication steps to get an embed token. First, it uses its Client ID and Secret to get an authentication token from Azure AD. Second, it uses that token to call the Power BI API and request a specific embed token for the report you want to show a user.

On the client-side, you'll use the Power BI JavaScript client library. Here's a conceptual code snippet of what that looks like:

// This config object would be securely generated on your server and passed to the client
const embedConfig = {
    type: 'report',
    id: 'REPORT_ID_FROM_POWER_BI',         // The ID of your Power BI Report
    embedUrl: 'EMBED_URL_FROM_POWER_BI',   // The Embed URL of your Report
    accessToken: 'EMBED_TOKEN_FROM_YOUR_SERVER', // The embed token your server generated
    tokenType: models.TokenType.Embed,
    settings: {
        panes: {
            filters: {
                expanded: false,
                visible: true
            }
        },
    }
},

// Find the HTML container where you want to embed the report
const reportContainer = document.getElementById('reportContainer'),

// Embed the report and display it to the user
const report = powerbi.embed(reportContainer, embedConfig),

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Best Practices to Remember

As you get more comfortable with embedding, keep these pointers in mind:

Embrace Row-Level Security (RLS)

RLS is your most important tool for multi-tenant applications. It lets you use a single report while ensuring users only see the data they're supposed to see (e.g., Tenant A can't see Tenant B's sales). You define the RLS roles in Power BI Desktop and then specify which role the user belongs to when an embed token is generated.

Manage Your Capacity Wisely

In Azure, you can script the pausing and resuming of your embedded capacity. If your customers only use your app during business hours, you can shut down the capacity overnight and on weekends to save significantly on your Azure bill. Remember to monitor your capacity's CPU usage, if it's consistently maxing out, it's time to scale up to a larger 'A' SKU.

Final Thoughts

Setting up Power BI Embedded gives you the power to bring world-class, interactive analytics directly to your customers within your product. Once you move through the initial configuration of the service principal, Azure capacity, and workspace, the process of developing and embedding new reports becomes a routine, repeatable flow that can quickly elevate your application's value.

For teams without the developer resources to manage this setup, or for those who simply need to create and share insights faster, embedding from an external platform can be a simpler path. At Graphed we handle all the data connections, analytics, and infrastructure for you. You can connect sources like Google Analytics, Shopify, and Salesforce in a few clicks, then ask conversational questions like "show me our top-performing campaigns by revenue" to instantly generate live dashboards, entirely skipping the complexities of capacity management and token generation.